# The Login Was Never the Weak Link
When ALPHV's affiliates walked into MGM Resorts International's data in September 2023, they didn't crack a password. They called the helpdesk, claimed to be an employee, and asked for an MFA reset. Ten minutes on the phone. Billions in damage.
That attack is two years old now, and the industry has learned roughly nothing from it. The conversation about identity security still centers on authentication — passkeys, FIDO2, phishing-resistant MFA. All of that matters. But attackers have already moved upstream. They're not at the login screen anymore. They're at the onboarding form and the account recovery queue, and those processes are shockingly undefended.
## The Gap Nobody Wants to Own
Authentication is a solved-enough problem at most mature organizations. Zero-trust architecture, conditional access policies, hardware tokens — the technical controls around "prove who you are each session" have improved meaningfully since 2018. The problem is everything that happens before and around authentication, which is largely a human process and largely a mess.
Account recovery is the canonical example. An employee forgets their password or loses their authenticator device. They call IT. The helpdesk agent, who has a queue to clear and a friendly caller on the line, asks some questions — name, employee ID, maybe the last four of a Social Security number — and resets the account. That's the process at most organizations. And attackers have catalogued it.
Social engineers spend time on LinkedIn before they pick up the phone. They know the org chart. They know the manager's name. They know there's a company all-hands this Friday because it was mentioned in a press release. They know enough to pass a cursory helpdesk verification with confidence. The MGM attack used exactly this playbook, and the vishing group Scattered Spider has run versions of it dozens of times since.
## Fake Workers: A Distinct but Related Threat
Account recovery attacks target existing employees. A parallel threat — arguably worse because it's harder to detect — targets the *creation* of identity from scratch.
The FBI has warned repeatedly since 2022 about North Korean IT workers securing remote employment at US companies using fabricated identities. These aren't crude scams. DPRK operatives maintain convincing LinkedIn profiles with work history, use identity farms with real-looking documents, and in some cases employ co-conspirators in the United States to pass physical verification checks. Once hired, they have legitimate credentials, legitimate access to internal systems, and sometimes elevated permissions to do their actual job.
The damage isn't always espionage. Some of these workers are funneling salaries back to weapons programs. Others are positioning for later exploitation — maintaining persistent access that could be weaponized when directed. A few documented cases involved the worker attempting extortion when discovered.
What makes this especially thorny is that these individuals pass the exact checks companies run: background verification services, document uploads, video interviews. The verification process was designed for a world where forging a W-2 was hard. That world doesn't exist anymore.
## Why Technical Controls Hit a Ceiling Here
The identity verification problem isn't fundamentally a technology problem, which is why throwing MFA at it doesn't help. It's a process problem with a trust assumption baked in.
Helpdesk agents are incentivized to resolve tickets, not to be paranoid. Organizations measure their IT support by time-to-resolution. Every suspicious caller an agent interrogates represents a risk of offending a real employee and generating a complaint. The structural incentives push toward being helpful, and attackers exploit that.
Similarly, HR onboarding flows were built around preventing administrative error, not adversarial document fraud. Verifying that someone *is who they claim to be* — rather than just that their paperwork is internally consistent — requires a different model.
Some organizations have moved toward identity verification vendors that do biometric liveness checks and document authentication in real time. Better than nothing. But liveness checks can be spoofed with enough effort, and document templates for most US states are available on fraud forums for a few hundred dollars.
## What Actually Changes the Calculus
The short list of controls that meaningfully reduce this attack surface:
For helpdesk/account recovery: Require employees to pre-register recovery contacts and secondary verification codes during onboarding — not at the moment of recovery when an attacker could be the one requesting. Privilege escalation during account recovery (any request to reset MFA or change primary contact information) should require manager co-authorization, not just caller verification.
For remote hiring: Video interview recordings reviewed against later identity documentation. Laptop GPS/network analysis to detect cases where a hired worker's device is operating from a location inconsistent with their claimed residence. Contractual clauses that allow immediate termination and credential revocation on identity discrepancy — and actually exercising them.
For both: Treat the account recovery and onboarding queues as attack surfaces with the same rigor applied to external-facing APIs. Log every identity-changing action. Alert on patterns — multiple recovery requests in a short window, recovery attempts from unusual geolocations, new hires requesting elevated access in the first 30 days.
None of this is exotic. Most of it is process change, not technology purchase.
---
## HackWire Analysis
The identity verification conversation is long overdue, but the framing matters. Most vendor coverage on this topic (including the source material that prompted this piece) positions the problem as a gap to be filled with a product — better verification software, smarter helpdesk tooling. That's partially right but misses the structural issue.
The real problem is that identity assurance has been treated as a one-time event. You verify someone at hire. You authenticate them each session. You recover their account when they ask. Each of these is handled by different teams, different tools, and different incentive structures, with no unified threat model connecting them.
Attackers understand this fragmentation intuitively. They know the hiring team doesn't talk to IT security. They know the helpdesk has a different process than the security operations center. They move laterally across these process gaps the same way they move laterally across network segments.
The organizations that are getting ahead of this — and there are a few — are treating identity as a continuous, auditable function with a single threat model, not a series of disconnected checkpoints. That requires organizational will more than technology spend.
The timing here matters too: remote work has permanently expanded the attack surface for fake worker placement, and the economics of AI-generated synthetic identities are dropping fast. The window to fix this before it becomes significantly worse is narrowing.
— HackWire Editorial
---
## Related Coverage