Global – October 19, 2026 -- About 62% of security breaches still involve the human element, according to the 2026 Verizon Data Breach Investigations Report. That figure is pushing retail and hospitality security teams to replace annual compliance videos with human risk management (HRM), which aims to change how employees respond to attacks in real time.
Scattered Spider uses AI voice cloning to turn help desk calls into footholds
Threat groups such as Scattered Spider scrape professional networks like LinkedIn to map organization charts and identify help desk staff and executives to impersonate. They then place high-pressure calls with AI-cloned voices, posing as locked-out employees. The goal is to get agents to reset a password and enroll multi-factor authentication (MFA) on a device the attacker controls.
Attackers moved to voice as email defenses improved, with vishing up 442%
CrowdStrike's 2025 Global Threat Report tracked a 442% surge in vishing. Verizon's 2024 report measured a median of 21 seconds for a user to click a phishing link and another 28 seconds to enter credentials.
High turnover, service culture and non-email channels widen retail exposure
Seasonal and part-time staff may reach their scheduled security awareness block only as their contracts near an end. Frontline workers and business process outsourcing representatives are rewarded for keeping customers happy, which attackers exploit by staging scenarios such as an angry high-value customer or a critical business delay.
Floor managers and guest-facing employees also rely on SMS, mobile apps, radios and collaboration platforms. Email-only controls cannot see those channels.
HRM extends testing to SMS, voice and collaboration tools
The HRM approach replaces generic phishing templates with scenarios built from campaigns targeting the sector. Workers who fail a simulation receive immediate feedback on the exact lure that fooled them.
Recommendations for security leaders:
- Test help desks and contact centers with AI voice calls paired with a follow-up text or email.
- Require out-of-band or step-up verification before any password or MFA reset.
- Score risk by role, combining behavioral signals, access levels and live threat intelligence, and prioritize coaching for finance teams and help desk agents.