Why Teenagers Become Hackers and Target Help Desks

Teenagers become hackers for reasons that look more like belonging than crime. They want skill, status, and a community that notices them. Companies feel the result when those teenagers join groups that attack help desks. In July 2025, UK police arrested four people aged 17 to 20 over attacks on Marks & Spencer, Co-op, and Harrods. The lesson for security teams is plain: young, persistent callers beat weak verification, so strengthen the help desk first.

Why Young People Are Drawn In

UK National Crime Agency research found that many young offenders start in gaming. They move from cheat sites and modding forums to criminal hacking forums. The NCA also found that money was not always the main motive. Accomplishment and respect from peers mattered more.

That matters for defenders, because it explains who the attackers are. They are not always career criminals. Many are young people chasing status in communities where bold attacks earn praise. Those communities reward results, and a successful help desk call is a result.

The barrier is also low. Tools and tutorials are easy to find, and social engineering needs no special software. It needs confidence, a script, and a phone.

What the Scattered Spider Arrests Showed

In July 2025, the NCA arrested four people on suspicion of Computer Misuse Act offences, blackmail, money laundering, and taking part in an organised crime group. They were two men aged 19, a 17-year-old, and a 20-year-old woman. The arrests followed attacks on M&S, Co-op, and Harrods that were linked to the Scattered Spider group.

Krebs on Security reported that Scattered Spider is known for social engineering, often impersonating employees or contractors to deceive IT help desks. It also noted that the group has long relied on recruiting minors for its riskiest activities.

The ages should not comfort anyone, because a young attacker with a good script can cause the same damage as an experienced one.

What the Retail Attacks Cost

The business impact was large. Help Net Security reported that Co-op limited much of the damage by having segmented networks and by taking its systems offline quickly, which stopped the ransomware from locking its computers. Even so, attackers still took customer and member data from M&S and Co-op.

Two lessons follow. First, preparation reduces damage. Segmentation and a fast decision to isolate systems made a measurable difference. Second, the first breach is often a person, not a system. That is why defenses at the help desk matter so much.

How the Help Desk Attack Works

CISA describes the method in its advisory on Scattered Spider. CISA says the group targets large companies and their contracted IT help desks. The actors first learn which steps are needed to reset passwords. They then phone employees and help desks to gather reset details about a target.

Finally, they make convincing calls that persuade help desk staff to reset passwords or transfer MFA tokens. After that, they take over accounts in single sign-on environments. CISA notes that these attempts are enriched by personal information found on social media.

So the pattern is simple. Learn the process. Collect personal details. Call with confidence. Ask for a reset. Each step uses information that is easy to find or easy to guess. This is voice phishing aimed at the one team paid to help.

Defenses That Work Against Persistent Callers

A confident young caller wins when the help desk treats politeness as a duty. Make verification a rule instead.

• Call back on a number you already hold. Never use a number the caller gives.
• Require a second approver for privileged accounts and any MFA reset or token transfer.
• Limit what the help desk can do alone. The fewer powerful actions one person can take, the harder the attack.
• Do not rely on personal facts. Birth dates and manager names are easy to find. Use a secret the attacker cannot research.
• Log every reset request, and review the log for repeated calls about the same account.
• Use phishing-resistant MFA on admin and help desk accounts.

Meanwhile, staff need to know it is acceptable to refuse. A help desk measured only on speed will rush. Measure verification quality too, and back the person who says no.

Warning Signs on a Help Desk Call

Teach the help desk what a social engineering call tends to look like. None of these signs proves an attack, but several together should trigger extra checks.

• Urgency with a reason. The caller says they are locked out before a meeting, a flight, or a deadline.
• A request to reset MFA or move a token. Attackers want to control the second factor, so treat these as high risk.
• Plenty of personal details, but gaps in process knowledge. The caller knows a manager’s name but not how a normal reset works.
• Reluctance to be called back. A real employee will accept a call to the number on file.
• Repeated calls about one account, or several accounts from the same caller.
• Pressure on the agent. Appeals to rank, guilt, or friendliness are standard tools.

When a sign appears, slow down, verify through a known channel, and report the call to security. A false alarm costs a few minutes. A missed attack can cost a business weeks.

Reduce What Attackers Can Learn About Your Staff

CISA notes that these calls are enriched by personal information from social media. So part of the defense is limiting what an attacker can find and use.

Start by checking what the public can see about your help desk and your executives. Job titles, reporting lines, and team names on professional networks all help a caller sound credible. You cannot hide everything, and you should not try. Visibility matters for hiring and trust.

Instead, change what a caller can prove. A caller who knows a manager’s name has proven nothing, because that fact is public. Move verification toward things only the real employee holds, such as a registered device or a callback through the directory. Then teach staff the simple rule: knowing facts about someone is not the same as being that person.

The same trick also works in chat, as Microsoft Teams phishing attacks show, where attackers pose as technical support. So apply the same verification rule to chat requests, not only to phone calls, and make sure the help desk knows that a message from a colleague’s account can be fake too. Finally, brief staff on what to do when something feels off. A short, rehearsed script for declining a request removes the awkwardness. It also helps new help desk staff, who are the most likely to feel pressure from a confident caller. Review the script after any real incident, and update it with the exact wording attackers used, because those phrases tend to repeat.

Practice the Call Before the Real One Arrives

Rules help most when people have rehearsed them. Threatcop Security Awareness Training (TSAT) runs simulations across multiple attack vectors, including voice, so help desk staff can meet a pressured caller in a safe setting. Its Employee Vulnerability Score shows who acts on a lure, and repeat-offender identification points coaching at the people who need it.

TSAT also reports average breach time, which shows how fast a lure turns into a compromise, and its Active Directory integration keeps role groups current. Threatcop Phishing Incident Response (TPIR) gives staff a one-click way to report a suspicious call or message from email or WhatsApp. TPIR runs sandbox analysis on the report, and its “Who Else” insight shows which other mailboxes received the same message. So one report protects the whole team.

The Bottom Line

Teenage attackers are not a mystery. They are young people chasing respect in communities that reward bold results, using the oldest trick there is: a confident voice on the phone. The July 2025 arrests showed how much damage that can do, and how well preparation limits it. So fix the weakest process first. Verify every reset through a call-back, require a second approver for sensitive changes, and do not trust personal facts. Then rehearse the call with your help desk, and make it safe to say no. Strong process beats a persuasive caller every time.

Frequently Asked Questions

Pallavi Verma

Pallavi Verma is a Partner Success Specialist at Threatcop, helping organizations strengthen their People Security Management programs. She works closely with clients and partners to reduce human-layer risk, improve security awareness, and ensure employees are equipped to make safer decisions every day. Pallavi is passionate about making cybersecurity practical, measurable, and people-friendly

Pallavi Verma

Pallavi Verma is a Partner Success Specialist at Threatcop, helping organizations strengthen their People Security Management programs. She works closely with clients and partners to reduce human-layer risk, improve security awareness, and ensure employees are equipped to make safer decisions every day. Pallavi is passionate about making cybersecurity practical, measurable, and people-friendly