Attackers often call the help desk instead of breaching it, talking agents into resets and MFA changes. Least privilege for support staff limits the damage.