Publication history: This article was first published on November 4, 2026. The October 29, 2026 date shown above is an editorial archive date for our October content, not the original publication date. The article includes reporting published on October 28, 2026.
Fake IT support calls are easier to stop when employees have a clear verification process. Before changing a password, approving a sign-in, enrolling a device, or granting remote access, end the unexpected call and contact your help desk through a number or portal your company already trusts. A familiar voice, company logo, or correct caller ID is not enough.
For a small business, the goal is to make that pause routine. Employees should know where to verify a request, and IT should follow the same process when someone asks for an account reset.
Why fake help desk calls deserve attention
On October 28, 2026, the Canadian Centre for Cyber Security warned about callers impersonating internal IT support at Canadian organizations, including legal and financial firms. The callers used urgent password, multi-factor authentication (MFA), and passkey enrollment requests to direct employees to fraudulent sign-in pages. Some calls displayed spoofed help desk numbers.
The alert concerns Canadian organizations. Its practical lesson applies to any business that relies on staff to recognize a legitimate support request.
Google Threat Intelligence Group and Mandiant described similar activity in August 2026. Attackers posed as help desk staff, used fake login portals to intercept credentials and conventional MFA responses, and stole data from cloud applications. These attacks can reach business information without first installing ransomware on a laptop.
A verification checklist for employees
Give staff a short procedure they can follow while busy, working remotely, or answering a call on a personal phone.
1 Pause before changing anything
Do not share a password, read out a sign-in or recovery code, approve an unexpected authentication prompt, or install software because an unverified caller asks. If they request screen sharing or remote control, stop until the request is confirmed.
A useful response is simple: “I need to verify this through our help desk. I’ll contact them using our normal support channel.” Employees should not need a manager’s permission to take this precaution.
2 Reconnect through a trusted channel
End the call. Use the support number saved in your company directory, your established support portal, or the contact instructions supplied during onboarding. Do not use a callback number, link, or QR code the caller provides.
The FTC’s guidance on tech support scams recommends contacting someone you trust at a number you know is genuine. Searching for a support number in the moment can introduce another risk because misleading results may lead to scammers.
If you cannot reach support, leave the request pending and use your company’s escalation contact. An urgent deadline does not make the caller’s instructions safer.
3 Verify the work as well as the person
Ask the real help desk whether the request exists, which account or device it concerns, and what action is authorized. If the caller gave you a ticket number, have support look it up independently.
A ticket number alone is not proof. Neither is knowledge of your manager’s name, job title, or software. Confirm the request inside the system your business already uses, rather than accepting a screenshot or forwarded message as verification.
4 Use the approved sign in route
After verification, open the application from your normal bookmark or company portal. Let IT explain the expected steps and confirm any new enrollment address through the established channel.
A page that displays your company’s name or Microsoft branding can still be fraudulent. Avoid deciding whether a site is safe from its appearance alone. If the instructions require an unfamiliar website, stop and verify again before entering credentials.
5 Report the attempt promptly
Tell IT about suspicious calls even if you did nothing the caller requested. Include the time, displayed phone number, claimed name, requested action, and any message or website address already received. Do not reopen a suspicious site to collect more evidence.
Say clearly if you entered a password, approved a prompt, downloaded something, or allowed remote access. That information helps IT choose the right response. Reporting a mistake quickly should be encouraged.
Make verification part of your support process
Employee awareness works better when the help desk has a documented process behind it. Ask your internal team or managed IT provider to define how staff verify incoming calls, how technicians verify account owners, and who approves exceptions.
Publish one set of support instructions where employees can reach it without signing in to a potentially compromised account. Include an after-hours contact and a backup path for someone whose phone or laptop is unavailable.
Agree with your provider on what a technician will never ask an employee to disclose. Put that guidance alongside the support contact details. If your business uses more than one IT vendor, explain which systems each vendor supports so an employee can check whether a request falls within the caller’s role.
For planned security changes, communicate the purpose, timing, approved portal, and support contact in advance. A legitimate rollout should not depend on employees accepting a surprise caller’s instructions.
Strengthen MFA without weakening recovery
Phishing-resistant MFA, including appropriately configured FIDO2 security keys and passkeys, should be part of the discussion. NIST explains that WebAuthn provides phishing resistance by binding authentication to the legitimate service’s domain. A fake website cannot simply collect and reuse that authentication the way it can relay a password and one-time code.
A scam mentioning a “passkey migration” does not mean genuine passkeys are broken. The attacker may be using the term to persuade someone to complete a weaker login or enrollment flow. Have IT review allowed authentication methods and fallback options, rather than assuming an MFA checkbox covers every sign-in path.
Verify resets and new device enrollment
Lost-phone requests and account recovery deserve particular care. A convincing caller should not be able to replace someone’s authentication method by supplying basic information about that employee.
Define the approved identity checks before an urgent request arrives. Use established contact records rather than a number supplied during the call, require additional approval for privileged accounts, and record the verification performed. A callback is one safeguard, not sufficient identity proof for every high-risk reset.
Review who can change recovery details, enroll devices, and approve exceptions. Keep an emergency recovery procedure that is controlled, documented, and tested.
If someone already followed the caller’s instructions
Contact your IT or security provider immediately through a trusted channel. Explain what happened and let them coordinate containment. Do not wait to see whether the account still works; a successful login does not show that an attacker has lost access.
For a suspected Microsoft 365 account compromise, Microsoft’s response guidance includes disabling the affected account during investigation, revoking sessions, and reviewing authentication methods, application permissions, administrator roles, and email forwarding. Password changes alone do not cover all of those access paths.
Your response team should also preserve relevant logs and assess which mailboxes, files, or connected services may have been accessed. If remote-control software was installed, identify the affected device and follow IT’s isolation instructions. Avoid wiping the device or deleting evidence yourself.
Management should involve its insurer, legal adviser, or other response partners when the incident plan calls for it. Any notification decision should follow the verified facts and applicable obligations.
Test the process before the next call
At your next staff meeting, ask an employee to show how they would verify an unexpected support request. Can they find the number without using a link from the caller? Does the after-hours route work? Would they know where to report an accidental approval?
Then ask IT to walk through a lost-phone recovery request. Fix unclear ownership or missing contact details before a real incident forces a rushed decision. Include new hires, temporary staff, and managers in the exercise.
Need help reviewing your help desk safeguards
Parried helps businesses connect everyday IT support with identity protection and cybersecurity. If your team is unsure how to verify support calls or handle account recovery, book a free 30-minute IT strategy session. We can discuss your current process, identify gaps, and help you choose a practical next step.