The Caller Says They Are from IT. Would Your Employee Hand Them the Keys?
The phone rings. The caller sounds calm and professional.
They say they are from IT and need the employee’s help fixing an urgent account problem. They already know the company name and may even know which systems the employee uses.
This is not a theoretical scenario. In January 2026, Google Threat Intelligence observed attackers pretending to be IT staff. They directed employees to convincing fake company login pages and asked for passwords and one-time verification codes. In some cases, the attackers gained access to company accounts and downloaded sensitive information.
The employee may believe they are helping the business. In reality, they could be opening the door to email, customer files and other company information.
What businesses should do now?
· Tell employees that IT should never request passwords or verification codes
· Give employees one trusted number or channel for contacting IT
· Ask staff to end unexpected calls and contact IT independently
· Make reporting a suspicious call simple and blame-free
· Test the process with a short practice scenario
· Use stronger sign-in methods that cannot easily be transferred to a caller
One action for today: ask your employees what they would do if “IT” called and requested an urgent verification code.
Comments