ALT-46 · Analysis · 23 Oct 2026
Twitter, July 2020: phoning the help desk
Teenagers talked Twitter employees into giving up credentials over the phone, then used internal admin tools to take over the accounts of presidents, billionaires and companies for a bitcoin scam.
- 15 Jul 2020Scam posts appear on prominent verified accounts within hours.
- 31 Jul 2020Arrests in the US and UK.
- Oct 2020New York's Department of Financial Services publishes its report.
- Accounts targeted
- 130Twitter, via Help Net Security
What failed
No software was exploited. Employees working from home at the start of the pandemic were persuaded to enter credentials and multi-factor codes on a phishing site. From there, internal tools gave too many people too much power over any account.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Admin tools are the most powerful product a company ships — to its own staff.
- Phone-based social engineering bypasses codes that a person can read out.
- Phishing-resistant authentication (security keys) is the structural fix.
What to do
- Use hardware security keys for staff with access to internal tools.
- Require a second person to approve high-impact account actions.
- Give help desks a way to verify callers that does not rely on what callers say.
Sources
- NY Department of Financial Services — Report on the Twitter investigation (press release, Oct 2020)
- Help Net Security — Twitter employees were spear-phished over the phone (Jul 2020)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-46 — Twitter, July 2020: phoning the help desk. 23 Oct 2026. altumptic.com/research/twitter-2020