TfL made 28,000 employees show up in person to reset a password

Between 31 August and 3 September 2024, attackers were inside Transport for London’s network.

The disruption was public. Refund systems went down. Photocard applications froze. What gets discussed less is what TfL had to do to climb back out. According to the National Crime Agency, all 28,000 employees were required to attend a TfL office in person for a password reset. TfL’s reported loss and recovery costs came to £29 million, and the BBC later reported that around 10 million people had personal data taken.

“[The attackers] compromised TfL’s network, forcing all 28,000 employees to attend a TfL office for a password reset.”

National Crime Agency

TfL had a working help desk. Every remote check a help desk normally leans on was off the table. Twenty-eight thousand people went to a building instead. With 28,000 accounts to reissue and an attacker who might still have been listening, the only verification anybody was willing to trust was a person standing in front of another person.

That instinct was correct. It also cost a fortune, and it is not available to a company whose staff are spread across four time zones and a spare bedroom.

The reset desk is where identity actually gets decided

Password resets usually get filed as a cost problem. Forrester Research puts the average IT labor cost of a single help desk password reset at $70. Run that across a help desk of any size and the business case for self-service writes itself.

The cost framing hides the part that matters. Every reset is an identity decision. Somebody, or something, concludes that the person asking is the person who owns the account, and then hands over a working credential. Get that wrong a hundred times and you have wasted $7,000. Get it wrong once on the right account and you have handed over the network.

Where Entra’s self-service password reset stops

Microsoft Entra ID’s self-service password reset does well at the job it was designed for: a user who registered enough authentication methods, still has them, and simply forgot a password.

Everything else falls outside it. The user who never finished registering. The user whose registered methods stopped being enough when policy went from one method to two. The user whose authenticator phone was lost or stolen. The hybrid tenant where password writeback was never configured. All of these are documented Microsoft behavior, and in every one of them SSPR’s answer is the same: contact an administrator. The full playbook for Entra ID account recovery covers every path a tenant has, including Microsoft’s own.

Whoever takes that call is the security control, whatever the architecture diagram says.

What that human is up against

CISA’s advisory on Scattered Spider (AA23-320A) describes the technique without much drama. The group calls the help desk, impersonates an employee, and asks for a password or MFA reset. It works often enough to have become the group’s signature.

BleepingComputer reported in May 2025 that the attackers behind the Marks & Spencer and Co-op breaches did precisely that: impersonated employees to the retailers’ IT help desks and had passwords reset on their behalf.

In June 2026, two of Scattered Spider’s leading members, Thalha Jubair and Owen Flowers, pleaded guilty on the first day of their UK trial to conspiring to commit unauthorized acts against TfL’s systems. Both were sentenced on 16 July 2026 to 66 months. US prosecutors had already charged Jubair in September 2025 over roughly 120 network intrusions that he and his associates are alleged to have carried out, at no fewer than 47 US entities, with victims paying more than $115 million.

~120 intrusions · 47+ US entities · $115m+ in ransoms

US Department of Justice charges, September 2025

None of that needed a zero-day. The M&S and Co-op intrusions needed a phone call and an agent with no way to check.

Introducing ATO Protect Account Recovery+ for Entra ID

ATO Protect Account Recovery+ does remotely what TfL did in its offices.

A user is locked out and cannot get back in. Instead of an agent weighing up a voice and an employee ID, Trusona verifies the person against authoritative records, including state DMV data over the AAMVA network and mobile network operator data, in real time on the user’s mobile device. There is no app to install and nothing to pre-register, so the check works the first time a user ever needs it.

When the verification passes, Trusona calls Microsoft Graph using your tenant’s own app registration, mints a single-use Temporary Access Pass (TAP), and delivers it to the user by SMS. The user signs in with the TAP and re-enrolls their authentication methods. Nobody on your team had to decide whether the voice on the line was genuine, because there was no voice on the line.

Yes, the TAP goes out over SMS. Here is what happens to the number first.

Delivering a credential by text message deserves the obvious objection, especially in this context. Krebs on Security reported that Jubair co-ran a Telegram channel hosting a SIM-swapping operation, selling the ability to redirect a target’s phone number to a device the attacker controlled. SMS is the channel that crowd was built to own.

So the number gets checked before anything is sent to it. ATO Protect runs SIM swap and man-in-the-middle detection across multiple international phone networks as part of the verification, and the TAP it issues can only be used once. A number that moved to a new device last week is a reason to stop, and the system stops.

What the integration asks for, and what it does not

Account Recovery+ needs no standing service account, no directory role, and no admin credentials held outside your tenant.

It uses an app-only access token from an app registration that lives in your tenant, carrying two narrowly scoped Microsoft Graph permissions that you consent to yourself. Trusona holds no directory password. The application is assigned no Entra directory role at all. Access tokens are short-lived, kept only until they expire and then re-acquired, and rotating the client secret takes effect on the next acquisition rather than requiring anything to be torn down.

Global Administrator appears nowhere in the running design.

Setup, end to end

Configuration happens in your own tenant, done by an administrator holding:

• Application Administrator, to create the app registration
• Privileged Role Administrator or Global Administrator, to grant admin consent for the two Graph permissions
• Authentication Policy Administrator, to enable the Temporary Access Pass method

At the end of it you hand Trusona three values: the directory (tenant) ID, the application (client) ID, and the client secret value. Those go to Trusona Customer Success over an agreed secure channel. Never by email, never by chat.

Four questions worth asking about your own tenant

• When someone calls because their authenticator phone is gone, what does your agent check before a Temporary Access Pass gets issued, and would a caller with ten minutes of LinkedIn research clear it?
• Is the verification standard the same at 11pm on a Friday as it is at 10am on a Tuesday?
• How much of your reset volume is legitimate users who simply fell out of SSPR scope, and what is that costing you at $70 of IT labor a call?
• If an attacker talked their way into one reset this morning, is there anything in your logs that would flag it before the credential got used?

The bottom line

TfL’s 28,000 in-person resets were not an overreaction. Standing in a room was the last check a caller could not fake, and TfL paid for it in time, money and disruption because the alternative was trusting the phone.

The opposite call gets made one reset at a time, and the bill arrives all at once.

The TAP integration takes that decision off the phone and off your agents. The user proves who they are against records an impersonator cannot borrow. Only then does Entra issue a TAP, single-use, minted by your own app registration, in your own tenant.

Frequently asked questions

Does Trusona need Global Administrator in Microsoft Entra ID?

No. The integration runs on an app-only access token from an app registration in your own tenant, carrying two narrowly scoped Microsoft Graph permissions. The application is assigned no Entra directory role at all, and Trusona holds no service account and no directory password. A Privileged Role Administrator or Global Administrator is needed once during setup to grant admin consent, and never again at run time.

What does the user actually receive?

A single-use Temporary Access Pass, minted through Microsoft Graph by your tenant’s own app registration and delivered by SMS. The user signs in with it and re-enrolls their authentication methods.

Does the user need an app installed or an identity registered in advance?

No. Verification runs in real time on the user’s mobile device against authoritative records, so it works the first time a user ever needs it, including for a user who never finished registering authentication methods in Entra ID.

Is SMS delivery safe against SIM swapping?

The number is checked before anything is sent to it. ATO Protect runs SIM swap and man-in-the-middle detection across multiple international phone networks as part of the verification, and the TAP can only be used once.

Which Entra roles are needed to set it up?

Application Administrator to create the app registration, Privileged Role Administrator or Global Administrator to grant admin consent for the two Microsoft Graph permissions, and Authentication Policy Administrator to enable the Temporary Access Pass method.

Sources: National Crime Agency, TfL conviction and sentencing releases (2026) · Crown Prosecution Service (July 2026) · BBC · Krebs on Security (June 2026) · US Department of Justice, District of New Jersey (September 2025) · CISA advisory AA23-320A · BleepingComputer, reported by Reuters (May 2025) · Forrester · Microsoft Learn, Temporary Access Pass and SSPR documentation for Microsoft Entra ID