In late April 2025, Marks & Spencer stopped taking online orders. Within days, the Co-operative Group and Harrods disclosed incidents of their own. The attacks on the UK's best-known retailers were widely attributed to the loose collective known as Scattered Spider, and the way in was not a zero-day or a malicious attachment. According to widespread reporting, it was a convincing phone call to an IT service desk.
M&S later estimated the hit to its operating profit at around £300 million. The UK's Cyber Monitoring Centre classified the M&S and Co-op incidents together as a Category 2 systemic event, with an estimated financial impact of £270 million to £440 million. In July 2025, the UK National Crime Agency arrested four people, aged 17 to 20, in connection with the attacks.
The playbook: talk your way past MFA
The technique is not new. A joint CISA and FBI advisory on Scattered Spider, published in November 2023 and updated since, describes actors who pose as company IT and help desk staff, and who call help desks pretending to be employees in order to get passwords reset and MFA moved to a device they control. The same playbook was linked to the 2023 attack on MGM Resorts, which the company said cost it about $100 million.
The flow is depressingly simple:
- Research a target employee using LinkedIn, breached data and company websites, ideally someone with privileged access.
- Call the service desk as that employee. Sound stressed, mention a new phone, and drop enough personal details to pass the usual questions.
- Ask for a password reset and a new MFA device to be enrolled.
- Log in as a legitimate user, with a legitimate second factor, and start moving.
From that point on, every control that trusts "a user who passed MFA" is working for the attacker.
Why this keeps working
Verizon's 2026 DBIR began tracking pretexting as its own initial access vector this year, and found that in phishing simulations the median click rate through mobile-centric channels, such as voice and text messages, was 40% higher than through email. Service desks are built to be helpful and measured on how quickly they close tickets. A caller who is locked out and late for a meeting is exactly the problem they are paid to solve.
The uncomfortable truth is that an MFA reset is a privileged operation, often more powerful than an admin login, and it is routinely protected by nothing more than knowledge-based questions.
How to harden the reset process
Verify out-of-band, never on the call itself
Do not accept identity proof from the person asking for the reset. Hang up and call back on the number already on file, or confirm through the employee's manager on a separate channel. Out-of-band verification works for the same reason out-of-band authentication does: the attacker has to compromise two channels instead of one.
Treat privileged accounts differently
Resets for administrators, finance staff and anyone with access to identity systems should need a second approver and, ideally, an in-person or video check. Attackers pick these targets precisely because the payoff is highest.
Tell the real user, through the old channel
When a password or MFA device changes, notify the account owner through the channel being replaced. A real employee who did not ask for a reset will raise the alarm quickly.
Watch what happens right after a reset
A reset followed by a login from a new location, an unfamiliar workstation, or a burst of directory queries is a strong signal. Location-aware signals, including location-based authentication and impossible travel detection, make that pattern visible instead of burying it in logs.
Use temporary measures, not permanent shortcuts
Many reset requests are really "I left my phone at home". Spriv lets an administrator postpone the second factor for a user for up to 72 hours, so the help desk can solve a genuine short-term problem without permanently re-enrolling a new device on the strength of a phone call.
Where adaptive MFA helps, and where it does not
No MFA product can stop an administrator from handing an attacker a new device. That is a process failure, and the fix is the process above. But the kind of MFA you run changes the odds around it.
Push-heavy MFA trains people to approve prompts without reading them, which is the root of MFA fatigue attacks. Spriv's adaptive MFA clears routine logins silently by pairing a known workstation with the environmental identifier from the user's phone. Because users rarely see a prompt, the one they do see gets attention, and a user who suddenly gets challenged, or who stops being able to sign in because their factor was moved, notices quickly.
And because the trusted pair is a specific computer and a specific phone environment, a freshly enrolled device signing in from somewhere new does not inherit the old trust. It starts from a challenge, which is exactly the moment your monitoring should be looking.