Help desk identity verification means confirming that a caller is who they say they are before the help desk resets a password, grants access, or changes anything for them. At Helion, every person who calls our help desk for support is verified first.
Last updated: October 23, 2026
Several years ago, one of our client dealerships had a vendor helping its corporate office with an accounting function. The vendor was approved. The dealer knew the vendor’s main contact. Nobody had a problem with the work itself.
The problem was how the work got done. The vendor had several employees of his own, and all of them were using his login to get into the dealership’s environment remotely, which meant that every one of them showed up as the same approved person to anyone looking at who had signed in. Neither the dealership nor Helion knew who those people were. Not until something stopped working and they needed support.
I lead the service teams behind our managed IT for dealerships: the service desk, field service, systems engineering, and the rest. I’ve spent more than 25 years leading managed services teams, and I believe the way a help desk handles a phone call says more about a store’s security than most people expect. This is the story of two of those calls, why we verify every caller, and how the check works for your staff.
Two Callers, Two Refusals
The first call came from one of the vendor’s employees. They asked our help desk for access and said they were with the dealership. We denied the request.
Then the vendor himself called. He was the known contact, the person the dealer had approved, and he also said he was a dealership employee. That request was denied as well. Same answer.
Both callers posed as people who worked at the store. Neither did. Our team determined that, gave them no access and no support, and then did the part I think matters most: we told the dealership what had happened and handed over the call recordings, so the people who owned the decision had what they needed to make it. In the end, the dealership found a new vendor for that function.
The work was legitimate. The way they were getting to it wasn’t.
That was years ago, and it hasn’t stopped. This fall, more people posing as dealership employees have tried to get support and access to a client’s environment. Verification stopped them too. The credit goes to the people doing the work, the technicians who answer those calls every day and don’t skip the step when a caller sounds sure of themselves.
The check held.
Why a Phone Call Is One of the Easiest Ways Into a Store
Ask what a caller can get from a help desk. A password reset. Elevated access to a system they shouldn’t touch. A remote session on a PC in the F&I office or the controller’s office. Each one is a door, and the person on the other end of the line only has to sound like they belong.
Caller verification is a step a help desk takes before it helps anyone: it confirms the person on the phone really is the employee they claim to be, using something only that employee should have, such as a code sent to contact details already on file. A name, a title, and a confident voice don’t count.
This isn’t a theory. A joint advisory from CISA and the FBI on the group known as Scattered Spider, last updated in July 2025, describes attackers who pose as employees and call IT help desks to get passwords reset and multifactor authentication moved to devices the attackers control. According to the advisory, the early calls are often just to learn what a help desk asks for before it resets a password. Then they come back ready.
Knowing facts about an employee doesn’t prove much either. Microsoft’s own guidance for help desks says traditional checks built on personal information and knowledge-based questions “are no match for today’s sophisticated attackers, who use phishing, social engineering, and even AI-powered voice cloning to bypass defenses.” A dealership employee’s start date, manager, and store location are often a LinkedIn search away. Our older posts on vishing and what voice phishing looks like cover the wider threat. The help desk is where it lands.
What happens if we do nothing? A friendly technician helps a friendly caller, and an attacker starts the week with a working login to your store. A convincing voice isn’t proof.
How We Verify Every Caller
Since November 17, 2023, Helion has verified the identity of every person who calls our help desk for support. Every caller. Not only the ones who ask for a password reset.
The preferred check is a one-time code. We send it to the email address or mobile number already on that person’s contact record, and the caller gives it to our technician. The code never goes to an address or number the caller gives us on the call, because a caller who isn’t who they say they are would simply give us their own. Simple rule.
| The situation | How we confirm who’s calling |
|---|---|
| You call and your contact record has a current email or mobile number | A one-time code goes to that email or mobile number on file, and you give it to the technician |
| You’re a registered user of the Helion app | You give the Support PIN shown in the app |
| A code or PIN isn’t possible | We call back through the dealership’s main number and ask for you, or confirm with your department manager |
| We placed the call to you | No verification needed, because the call is outbound and we chose the number |
| Nobody can confirm who you are | No support and no access until you’re verified |
That last row is the one people ask about. It’s firm on purpose. If a caller can’t be verified, the answer isn’t a lighter check or a favor for someone who sounds senior. They get help as soon as they’re verified, and not before.
None of this changes how fast someone picks up. A live technician answers in 82 seconds on average, and our dealership IT help desk is open whenever dealers are open, 7 days a week. Security support runs 24/7: live, US-based analysts monitor your systems and step in the moment they see signs of an attack. Verification is one step inside the call, done by the same team that’s helping you.
It’s a short step. It’s also the one that keeps a stranger out.
What It Asks of Your Staff
Here’s the honest part. The code goes to the details on record, so the check is only as quick as your contact list is current.
When a salesperson gets a new cell number, or a service advisor moves to a sister store, or someone leaves on a Friday and we don’t hear about it until a week later, the record is out of date. Stores change fast. The check still works. It just takes the longer route through the dealership’s main number or the department manager. So the one habit I’d ask for is simple enough to say and easy to forget on a busy Saturday: when someone’s contact details change, or someone leaves, tell us that day instead of waiting for the next time they call.
Call it shared ownership. We run the check on every call. Your store keeps the list it checks against.
Some of your managers have been calling our technicians by first name for years, and the first time one of them is asked for a code, they may take it a little personally. I understand that. But a general manager who’s asked for a code isn’t being doubted. They’re being protected, along with every customer record in the DMS and every login in Microsoft 365, and since a title is the first thing a fake caller claims, a title can’t be what gets someone past the check. Our security awareness training for dealership employees covers the phone side of this too, if your team wants to hear what these calls sound like from the other end.
Keep the list current and the check stays quick.
Questions to Ask Any IT Provider About Caller Verification
You don’t have to be a Helion client to ask any of these, and I’d put them to whoever runs your help desk today, whether that’s your own IT person or an outside provider.
- Do you verify every caller, or only the ones who ask for a password reset?
- Where does a verification code go? The right answer is contact details you already had on file. “Wherever the caller tells us” is the wrong one.
- What happens when a caller can’t be verified, and who can overrule that? Ideally nobody on the phone.
- If someone posing as one of our employees calls you, do we hear about it?
- Can you show us the call afterward? In the vendor story above, the recordings are what let the dealership decide.
- How do you find out when someone leaves our store, and how fast does their contact record change?
- Does the same check apply to vendors who work in our environment?
A provider with a real process will answer most of these in a sentence each. Vague answers are an answer too.
Before Your Team Calls Us
Our general manager hates waiting. Do they get verified too?
Someone changed cell phones last week. Now what?
Will verification slow us down when something’s broken at the store?
We have a vendor who calls Helion for help in our systems. Is that allowed?
If Helion calls me, do I need a code?
The Part Only Your Store Can Keep Current
I don’t believe a dealership has to choose between a help desk that’s easy to reach and one that’s hard to fool. Ours is built to be both. Both matter. The vendor story shows why the second half can’t slip. Every caller is checked. Nobody gets an exception for sounding busy, senior, or sure.
The next step is yours. It’s small. Ask your office manager or controller who owns the list of people allowed to call your IT provider, and how quickly it changes when someone joins or leaves. If you’d like us to look at that along with the rest of your setup, our complimentary IT and cybersecurity assessment covers how your stores are protected, the help desk included.
We run the check on every call. Keeping the contact list right is the one part only your store can do.