Talk-Past Attack
A talk-past attack is initial access gained by persuading a person to hand over, reset or approve access, so that authentication is satisfied rather than broken: credential phishing by email, text or phone, a help desk reset, an OAuth consent grant, a push approval or a SIM swap. Start with Identity coined the term in the Identity Breach Report 2026, along with the talk-past share, the share of human-account incidents whose initial access falls in that family.
In the Identity Breach Database, the talk-past share was 32.1% in 2021-2022, 24.1% in 2023-2024 and 41.4% in 2025-2026, while stolen, stuffed or sprayed passwords fell from 51.7% to 17.2% of human-account incidents between the last two periods. The targets moved too: 7 of the 13 social engineering incidents in 2025-2026 involved CRM or SaaS data, often a phone call persuading staff to approve a malicious connected app. Talk-past attacks are why MFA alone is not the fix: phishing-resistant MFA stops relayed codes and push approvals, but help desk resets and consent grants need caller verification, admin approval for OAuth apps and limits on who can authorize integrations.
See also: help desk social engineering, OAuth consent phishing, MFA fatigue and push bombing, vishing, phishable MFA, MFA blind zone
Related on Start with Identity
- GlossaryCalling Name Presentation (CNAP)
Calling Name Presentation (CNAP) is a telephone network service that shows the called user the caller's name, supplied by the network rather than by the caller,
- GlossaryNumber Matching
Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve,
- GlossaryOne-Time Password (OTP)
A one-time password (OTP) is a code that is valid for a single sign-in or transaction, either generated by an authenticator from a shared secret, as in HOTP ([R
- ExpertCo-creator of BloodHound, AD CS attack research
Will Schroeder co-created BloodHound and has published a long run of Active Directory research, including the Certified Pre-Owned work on Active Directory Certi
- BlogKratos phishing-as-a-service dismantled: 200 servers, 1,800 customers, MFA walked past every time
German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to re
- PodcastThe ID Talk Podcast
Trade-press interviews on biometrics, digital ID, identity documents, and deepfakes from the ID Tech newsroom. More than 200 episodes since 2019.