# talk-past-attack

Source: https://startwithidentity.com/glossary/talk-past-attack/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A talk-past attack is initial access gained by persuading a person to hand over, reset or approve access, so that authentication is satisfied rather than broken: credential phishing by email, text or phone, a help desk reset, an OAuth consent grant, a push approval or a SIM swap. Start with Identity coined the term in the [Identity Breach Report 2026](https://startwithidentity.com/reports/identity-breach-report-2026/), along with the **talk-past share**, the share of human-account incidents whose initial access falls in that family.

In the [Identity Breach Database](https://startwithidentity.com/breaches/incidents/), the talk-past share was 32.1% in 2021-2022, 24.1% in 2023-2024 and 41.4% in 2025-2026, while stolen, stuffed or sprayed passwords fell from 51.7% to 17.2% of human-account incidents between the last two periods. The targets moved too: 7 of the 13 social engineering incidents in 2025-2026 involved CRM or SaaS data, often a phone call persuading staff to approve a malicious connected app. Talk-past attacks are why MFA alone is not the fix: [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) stops relayed codes and push approvals, but help desk resets and consent grants need caller verification, admin approval for OAuth apps and limits on who can authorize integrations.

See also: [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/), [OAuth consent phishing](https://startwithidentity.com/techniques/oauth-consent-phishing/), [MFA fatigue and push bombing](https://startwithidentity.com/techniques/mfa-fatigue-push-bombing/), [vishing](https://startwithidentity.com/glossary/vishing/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [MFA blind zone](https://startwithidentity.com/glossary/mfa-blind-zone/)