> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Run a help desk test

> Call your own IT help desk as a locked-out employee and see whether the agent verifies the caller before resetting anything.

A help desk test does not call your staff. It calls your help desk numbers, pretending to be one of a few employees who agreed to lend their name. Each call is graded on whether the agent verified the caller and whether a reset was granted.

The console describes it like this: **Call your IT help desk as a locked-out employee and see whether the agent verifies the caller before resetting a password or reading out a code.**

> [!NOTE]
>
> The employees named are never called. They only lend their name, and only after you record their consent on their contact.

## Before you start

* An attacker with a voice. The cover story and script are written for you per call. See [Create an attacker](https://docs.deepblocker.ai/vishing/attackers.md).
* At least one contact with **Can be impersonated in help desk tests** ticked on their contact form. See [Add the people you will call](https://docs.deepblocker.ai/vishing/people.md).
* The help desk numbers, in international format, and their opening hours.
* Agreement from whoever owns the help desk. You will name them at launch.

## Steps

**1. Choose Help desk test**

Open **Red Team**, **Campaigns**, **New Campaign**. Pick **Single call**, then under **Single call type:** pick **Help desk test**. A box titled **How a help desk test works** appears. The wizard's second step is now **Help desk** instead of **Who is called**.

**2. Who calls**

Pick an attacker. Its voice is used on every call. No template is needed: each call gets one of three cover stories, with the employee's own facts filled in.

| Cover story | Used |
| - | - |
| **Locked out before a client meeting** | First call, then every third |
| **New phone and lost MFA** | Second call, then every third |
| **Travelling and cannot receive codes** | Third call, then every third |

**3. Help desk**

Fill in four blocks.

| Block | What to enter | Limits and defaults |
| - | - | - |
| **Help desk numbers** | One number per line, for example +44 20 7946 0000. **Add another number** adds a line | 1 to 5 numbers |
| **Help desk opening hours** | **Opens**, **Closes** and **Time zone** | 09:00 to 17:30 |
| **Employees the caller may pretend to be** | Tick the consenting contacts listed | Up to 20 |
| **What counts as a failure** | Tick the things that count | See below |

The failure ticks are: **A reset was granted, or a code or temporary password was read out** (on), **A reset was promised, even if it had not happened by the end of the call** (on), and **Personal details about the employee were confirmed (manager, email, employee ID)** (off). If you untick all three, a granted reset still counts.

The box **What will happen** shows the call count: each number once per employee, inside the opening hours.

**4. From where and when**

The same step as any campaign. See [Schedule, pacing and retries](https://docs.deepblocker.ai/vishing/campaigns/schedule.md). The help desk opening hours win over the call window: a campaign launched at night waits for the desk to open.

**5. Authorise and launch**

Fill in the authorisation block as usual, then tick **The help desk is in scope for this test** and write who agreed in the box below it. The helper text reads: **A help desk campaign cannot start without this.** See [Authorise and launch](https://docs.deepblocker.ai/vishing/campaigns/authorise.md).

The summary card shows the numbers, hours, employee count and what counts as a failure. Click **Launch**.

## What happens next

The caller rings each number, inside the opening hours, and asks for a reset. It accepts a callback, a manager's approval or a ticket politely and ends the call. It never threatens, never asks for anyone's own password, and stops at once if the agent says they will report the call or asks whether it is a test.

If coaching is on, help desk staff hear a help desk version of the reveal at the end of a failed call. See [Coaching](https://docs.deepblocker.ai/vishing/results/coaching.md).

The results show one row per agent, with the verification observed on each call: **No verification**, **Callback to a number on file**, **Manager approval**, **Ticket or self-service** or **Identity questions**, and whether a reset was granted. The first line you read is in the form **2 of 6 help desk calls ended with a reset granted without verification.** See [Read your results](https://docs.deepblocker.ai/vishing/results/overview.md).

## Problems

> [accordion] No employees appear to tick
>
> The step reads: **No contact has given consent to be impersonated yet. Open a contact, tick "Can be impersonated in help desk tests", then come back.** Contacts without that tick are hidden.

> [accordion] It says every number must be in international format
>
> Each number needs a leading plus and the country code, for example +44 20 7946 0000. Spaces are fine.

> [accordion] Launch stays grey after the authorisation block
>
> Tick **The help desk is in scope for this test** and write at least a few words in the note. The error reads: **Tick the box and name the help desk that is in scope.**

> [accordion] The calls did not start
>
> The desk is closed by the hours you set. Check **Help desk opening hours** and its time zone. Your fair testing rules do not apply to help desk calls, so they are not the cause.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.