1. Your inbox suddenly fills with hundreds of sign-up emails. Then “IT support” calls on Teams to help. What’s going on?
Answer: The flood was the setup for a fake IT call. Storm-1811 bombed inboxes, then posed as IT on Teams and asked victims to open Quick Assist (Microsoft, 2024).
2. “IT” asks you to open Quick Assist or AnyDesk and read out the code. You:
Answer: End the call and contact IT through the usual channel. A remote-access code hands your screen to whoever asked. Microsoft saw a third employee give access after two others refused.
3. In 2023 an attacker called the help desk run for Clorox, posed as a locked-out employee, and asked for a reset. What happened?
Answer: The help desk reset the credentials. According to Clorox’s lawsuit, the agent reset the password on the second call without verifying identity. Clorox claims about USD 380M in damages; Cognizant disputes it.
4. How did attackers get into Marks & Spencer in April 2025?
Answer: By impersonating someone to a third-party help desk. Chairman Archie Norman told UK MPs it was social engineering — “a euphemism for impersonation.”
5. Co-op’s attackers answered the help desk’s security questions correctly. What does that prove?
Answer: Security questions alone aren’t proof of identity. Answers can be researched or stolen. Strong identity checks need more than knowledge questions.
6. Your phone keeps buzzing with MFA approval requests you didn’t start. You:
Answer: Deny them and report it — someone has your password. MFA fatigue relies on you tapping “Approve” just to stop the noise. CISA documents it in Scattered Spider attacks.
7. A new phone number appears as an MFA method on your account, but you didn’t add it. That means:
Answer: An attacker may be setting up a way back in. Attackers add their own MFA method after stealing a password. Adding one often doesn’t require signing in again.
8. Your phone suddenly shows “No service” and you can’t make calls. Possible scam?
Answer: Yes — it can be a SIM swap. In a SIM swap a carrier is tricked into moving your number, so codes by text go to the attacker.
9. Who do attackers impersonate when they call the help desk?
Answer: Real employees, often with real details. They pick a real person, often found on LinkedIn, and arrive with their name, ID and manager — enough to sound right.
10. Best rule for anyone contacting you “from IT”:
Answer: You contact IT back through the channel you already know. Unexpected IT contact plus a remote-access or code request should always be verified the other way round.