An NHS worker does not always stay in one place for long. Staff move between trusts, departments, wards and clinical settings. Locums and temporary workers may arrive with little notice. Others split their time across several sites or change roles as service needs shift.
While flexibility is essential to healthcare delivery, it can make identity verification harder for the service desk. NHS organizations therefore need a verification process that reflects how their workforce operates. It must work for permanent staff, locums, temporary workers and people moving between organizations, without relying on personal familiarity or informal approval.
The Increasing Threat to Healthcare Service Desks
The service desk for organizations in any industry is an attractive target, as agents can reset passwords and unlock accounts. In critical industries like healthcare, exploiting those processes could grant attackers access to critical accounts and impact patient care.
The NCSC assesses that threat actors are already using AI to improve reconnaissance and social engineering. It expects this to increase the volume and impact of cyber intrusions through to 2027, largely by strengthening existing attack methods rather than inventing new ones.
Impersonation is Easier
Supported by AI, an attacker can create messages or scripts that reflect NHS terminology, reporting lines, locations and working patterns. A caller may know the employee’s role and current department, for instance understanding that the person is a locum or has recently moved site. None of that proves they control the identity, but it might be enough to pass weak verification methods.
AI can also improve the quality of phishing emails and written service desk requests. The traditional warning signs of poor spelling or unusual phrasing are less dependable when attackers can produce polished, context-aware messages at scale.
AI Voice Cloning Makes Vishing More Convincing
Tone and delivery play a massive part in social engineering against the service desk, and AI-generated audio can make phone-based impersonation sound more credible. An attacker may use a short sample taken from a public video, voicemail or online meeting to imitate a member of staff or senior manager.
Voice cloning does not need to be perfect, as service desk calls are often brief, may take place over poor connections and can involve callers the agent does not know personally. Those conditions leave room for an attacker to explain inconsistencies.
Where Identity Verification Methods Fall Short
The risks facing the service desk are magnified in a mobile environment, where there is a steady flow of new and changing identities for agents to support. Accounts are created for joiners, locums and temporary staff, while existing users change roles or move between trusts.
That environment could put identity verification under strain, particularly if the methods used are weak by today’s standards.
Security questions may confirm that a caller knows personal or employment information, but don’t necessarily confirm that the caller is the legitimate account holder. Data breaches, social engineering, websites, and social media can all reveal sensitive or personal information that an attacker can use to impersonate an NHS worker.
Email verification can have similar limits. A message sent to the account being recovered is of little use if the caller cannot access it, while sending a code to a personal address supplied during the call simply proves that the caller controls that address. It does not prove that the address belongs to the employee.
The problem becomes more pronounced when identities are being created and updated all the time. New starters may not yet have a well-established set of trusted contact details. Temporary workers may use personal devices. Staff moving between organizations may have several email addresses or accounts. Records may also be incomplete or out of date.
This gives service desk agents less reliable context at the point when they are being asked to take a sensitive action.
Reliably Verifying Users with Specops Secure Service Desk
Specops Secure Service Desk helps service desk teams replace checks that are vulnerable to social engineering with forced user verification. Agents can authenticate callers using existing factors and third-party services such as Duo, Okta, PingID and Symantec VIP, rather than relying on knowledge-based questions alone.
There is no separate end-user enrolment requirement. Specops Secure Service Desk can use existing identity data in Active Directory or Microsoft Entra ID and supports more than 15 MFA factors, helping organizations verify different user types, including those without access to a mobile device.
Once the caller has been verified, agents can securely:
- Unlock Active Directory or Entra ID accounts
- Reset passwords
- Require a password change at next sign-in
Specops Secure Service Desk can also protect agent access with MFA and export service desk verification events through the Specops Event API. This gives security teams a clearer audit trail and allows verification activity to feed into SIEM, analytics and SOC workflows.
The result is a more consistent process for high-risk service desk actions, without adding unnecessary friction for users or agents.
Make Secure Verification Part of the Service Desk
A mobile NHS workforce needs support processes that work across roles and locations, but that flexibility should not come at the cost of weaker identity checks. As AI makes impersonation more convincing, service desks need a consistent way to verify the person behind the request.
Specops Secure Service Desk helps service desks securely verify users before sensitive actions take place. With support for Active Directory and Entra ID, more than 15 MFA factors, third-party authentication services and SIEM integration, it helps reduce social-engineering risk without adding unnecessary friction.
If you’re interested in seeing how Specops can help your service desk make password resets and account recovery more secure, contact us today.
