1. Executive summary
A survey of 700 IT and security decision-makers at organisations of 500 or more employees in the US, UK, France and Germany found that 95% had observed frontline workers using authentication workarounds in the past 12 months: staying signed in on shared devices, sharing credentials, and attempting to bypass MFA prompts. The same population reports that 62% of organisations have seen a confirmed or suspected attempt to abuse account recovery, password reset or account unlock in the past year, with 28% able to point to a confirmed case. The exposure is concentrated at the service desk, where identity proofing for a reset is the control that decides whether an attacker walks away with a working account, and where 60% of respondents report a confirmed or suspected social-engineering attempt in the same period. For EMEA financial services the risk is operational rather than exploit-driven: shared sessions and shared passwords break the link between an account and a person, which degrades transaction authorisation, audit trails and fraud attribution on the same accounts that move money. No CVE, no tracked actor and no malware are associated with this item; the figures come from a single vendor-sponsored survey and should be treated as directional.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This is a survey item, not an incident report. There is no observed intrusion, no exploited component and no malware. What follows is the mechanism the survey describes, reconstructed from the reported behaviours, with the survey's own figures attached. Every percentage below is from the Sapio Research survey of 700 respondents conducted in August, commissioned and reported by Help Net Security; it is single-sourced and self-reported, and the article does not name the survey's sponsor or publish its methodology.
The workaround pattern, as described:
- A frontline worker on a shared workstation stays signed in rather than logging out at shift change, so the next worker operates under the previous worker's identity.
- Credentials are passed around a team, so anyone holding the password can authenticate as the account owner.
- Workers attempt to bypass MFA prompts to avoid repeated challenges, particularly where gloves or protective equipment make login slow.
- Separately and from outside, an attacker targets the recovery path: account recovery, password reset or account unlock, usually by convincing a service desk to reset credentials for a caller who cannot prove identity.
The survey puts 37% of frontline workers hitting an authentication problem in a typical month, at roughly 2.5 hours lost per affected worker per month. The most-cited causes tie between logging in while wearing gloves or protective equipment and delays switching between devices and between users on shared devices; password resets, connectivity failures and repeated MFA prompts sit just behind, and the top nine causes fall within six percentage points of each other. No single fix addresses the majority of the problem, which is why workarounds persist.
The recovery path is the part with direct attacker relevance. Identity proofing at reset is inconsistent across the sample: respondents named employee badges, email, SMS codes, biometrics and manager approval, and no single method is used by a majority. A help desk that verifies a caller by email or SMS is relying on channels an attacker can take over, and 48% of respondents said they are very or extremely concerned about AI-enabled impersonation, the same share that worries about conventional social engineering. The survey does not describe a specific impersonation technique, tool or actor; the concern is stated, not evidenced.
Passwordless deployment does not close the gap on its own. Passkeys are in use at 28% of organisations, and 45% of those still keep a password alongside them, which leaves a credential a caller can talk a service desk into resetting. Among the 261 organisations relying on SMS codes, authenticator app codes or push approvals, 37% confirmed an unauthorised recovery, reset or unlock attempt, against 28% across the full sample. Organisations running a mix of password and passwordless methods reported credential sharing at twice the rate of organisations where passwordless login leads.
Confidence caveats. The 62% figure combines confirmed and suspected cases; the confirmed-only figure is 28%. The survey is vendor-adjacent (the article quotes the FIDO Alliance executive director), self-reported, and covers healthcare and manufacturing, not financial services. The article gives no breakdown by sector, no named threat actor, and no technical indicators. Treat the direction of the findings as credible and the specific percentages as indicative only.
4. Mitigation & containment
P1 within 24 hours
- Inventory every account that can be used on a shared frontline workstation and confirm whether concurrent or persistent sessions are permitted; where they are, require re-authentication at shift change or device handover rather than relying on session timeout.
- Pull service-desk logs for the past 90 days for account recovery, password reset and unlock events, and identify any where identity proofing was completed by email or SMS alone. Those are the events an impersonator would target; review them for callers who could not be matched to a known employee or manager.
- Require manager approval, in addition to any self-service channel, for resets on accounts with payment, trading or funds-transfer authority.
P2 within 72 hours
- Rewrite the service-desk identity-proofing procedure so that reset verification does not rest on a channel the caller controls (email, SMS). Use a callback to a number on record, badge or biometric check, or in-person verification, and record which method was used against each reset.
- Where passkeys are deployed, remove the fallback password for accounts that do not need it; the 45% figure shows the fallback is the residual exposure.
- Enforce device-level session lock and automatic sign-out on shared workstations, and test that a new user cannot resume the previous user's session.
P3 within 7 days
- Measure the actual authentication time cost for gloved and PPE-wearing staff and fix the worst cases (badge tap, longer PIN entry windows, device-bound passkeys), because the survey ties workaround behaviour to login friction.
- Run a phishing-resistant MFA migration plan that sequences shared-workstation and service-desk accounts first, and track the mixed-mode population separately, since that group reported double the credential-sharing rate.
- Brief the service desk on AI-enabled voice impersonation and add a challenge question or out-of-band verification step for high-value resets.
5. Indicators of compromise
No indicators of compromise available in the source material.
The survey describes behaviours rather than atomic indicators. The behaviours below are the observable patterns worth hunting for; they are not machine-pivotable and are not reproduced in the copyable block.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Same account active across shift change on a shared workstation | IdP session logs, workstation event logs | Medium (survey-reported pattern) |
| Credential sharing within a team | IdP impossible-travel and concurrent-session alerts | Medium (survey-reported pattern) |
| Repeated MFA prompts followed by MFA bypass attempts | IdP MFA challenge and failure logs | Medium (survey-reported pattern) |
| Unauthorised account recovery, reset or unlock | Service-desk ticketing and IAM audit logs | Medium (28% confirmed, single source) |
| Social engineering of the service desk | Service-desk call records, ticketing notes | Medium (60% confirmed or suspected, single source) |
6. Detection
Insufficient indicators to author detection rules.
The source contains no file artefacts, command lines, registry keys, process names or network indicators. The behaviours in §5 are better expressed as identity-provider analytics queries against the client's own logs than as YARA or Sigma rules, and the survey gives no field values to build those against.
7. Sources
- Help Net Security, "Your frontline workers have a workaround for that MFA prompt", 2026-10-20. https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/ (single source; reports a Sapio Research survey of 700 IT and security decision-makers, August, US/UK/France/Germany, organisations of 500+ employees).
8. Adverse Trace position
Adverse Trace assesses this as a medium-severity operational identity risk rather than a vulnerability or campaign. There is no CVE, no CISA KEV entry, no tracked actor and no malware; the exposure is the gap between an account and the person using it, and the service desk is where that gap is widest. For EMEA financial services clients the impact lands on transaction authorisation, audit integrity and fraud attribution, not on endpoint compromise. The figures are single-sourced and self-reported, so we treat them as directional and will not cite them as measured prevalence in a client's own estate. We will monitor for follow-on reporting that names specific impersonation techniques or service-desk fraud cases, and we will reissue this note if a named actor or technical indicator set emerges. Clients who want to act now should start with the P1 service-desk reset review, because that is the control the survey shows is both most attacked and least consistently applied.
Published via PulseTrace — Adverse Trace threat intelligence.