Employees have heard the standard phishing advice. Don’t click suspicious links. Don’t open strange attachments. Watch for odd email addresses, spelling mistakes, and messages from people you don’t recognize.
All of that advice still has value, but social engineering attacks on businesses have moved beyond suspicious emails.
Attackers are now more likely to impersonate real people, familiar vendors, IT support teams, executives, or employees who appear to need help. They may call, text, email, or send a message through a collaboration tool. They may ask someone to approve an MFA prompt, reset an account, share a verification code, update payment information, or grant access to a system.
The Canadian Centre for Cyber Security notes social engineering involves the impersonation of leaders, colleagues, and business partners, and AI can make these attacks more realistic and personalized. It also identifies MFA fatigue as a tactic where repeated prompts are used to pressure someone into approving access.
Okanagan businesses need clear identity-verification procedures for account resets, MFA changes, vendor requests, and urgent access changes.
What Social Engineering Looks Like Now
Modern social engineering is designed to make a request feel normal enough to act on quickly.
A fake employee may call the help desk and say they’re locked out before a meeting. Someone pretending to be IT support may ask an employee to approve a login prompt or read back a verification code. A vendor impersonator may request a payment change, file transfer, or password reset. A message may appear to come from a manager, supplier, software provider, or trusted business contact.
These attacks work because they’re built around pressure and familiarity.
The person contacting your team sounds calm, informed, and confident. They may know names, job titles, vendor relationships, recent company activity, or the tools your business uses. Public websites, LinkedIn profiles, email signatures, social media, and previous breaches give attackers enough detail to sound believable.
Employees are trained to look for obvious signs of fraud, but the signs are becoming much harder to spot.
Why “They Sounded Legitimate” Is Not Enough
A convincing voice, familiar name, or urgent tone should never be treated as proof.
Social engineering attacks rely on employees who want to be helpful. If someone sounds frustrated, rushed, senior, or technically knowledgeable, it’s easier to respond than to slow the request down. That’s exactly what the attacker wants. A fake IT support request may sound like this:
“Hi, it’s IT. We’re seeing suspicious activity on your account. I need you to confirm your password so we can secure it.”
Or:
“I’m sending you a verification code now. Read it back to me as soon as it comes through so we can stop your account from being locked.”
The language sounds familiar. The request sounds urgent. The person sounds confident. None of those details prove the request is real. Employees need permission to pause, verify, and follow the approved process, even when a request appears to come from someone important.
The Help Desk Is Now a Target
Help desks and account recovery processes are attractive targets because they’re designed to get people back to work quickly.
A good support process allows employees to regain access when they forget a password, lose a device, change phones, or get locked out of an account. If the process relies too much on memory, recognition, or informal approval, an attacker may be able to exploit it.
Common weak points include password resets approved after minimal verification, MFA changes made over the phone, recovery codes shared too easily, new devices trusted without enough review, or vendor access approved through email alone.
This can be especially risky for smaller businesses where people know each other well, and support requests happen informally.
A help desk process doesn’t need to be difficult, but it does need to be consistent. The person handling the request should know what information can be used to verify identity, which requests need manager approval, and which actions should never happen through an unexpected call, text, or message.
A clear process protects both the business and the employee receiving the request.
MFA Needs Guardrails
Multi-factor authentication is one of the most important protections a business can use, but attackers have adapted their tactics.
MFA reduces the risk of compromised accounts, especially when passwords are stolen or guessed. The Canadian Centre for Cyber Security recommends using MFA where possible and, for stronger protection, moving toward phishing-resistant options such as FIDO-based solutions.
For employees, the rule needs to be simple: never approve an MFA prompt you didn’t initiate.
Employees should also know that verification codes are sensitive. A legitimate IT support person shouldn’t need an employee to read back an MFA code from an unexpected call or message. If someone asks for a password, MFA code, recovery code, or approval of a login prompt, the employee should stop and verify the request through an approved channel.
Businesses need to review how MFA resets are handled. If an attacker can convince someone to remove MFA, add a new device, or reset access with weak verification, MFA becomes less effective.
MFA is valuable, but it works best as part of a broader cybersecurity strategy that also considers account recovery, admin permissions, employee training, and monitoring.
Tighten Account Recovery Without Slowing the Team Down
Strong verification doesn’t need to make every support request painful. A good identity verification process is clear, repeatable, and easy to apply under pressure.
For account recovery, password resets, MFA changes, or high-risk access requests, businesses reduce risk by using known contact information instead of phone numbers or email addresses provided during the request. A callback to an approved number is safer than continuing a conversation started by someone unexpected.
Higher-risk changes may also need manager approval, especially when the request involves administrative permissions, financial systems, client information, vendor access, or sensitive files.
Businesses should limit who can reset passwords, change MFA settings, approve vendor access, or create exceptions. Fewer people with elevated permissions means fewer opportunities for an attacker to pressure the wrong person.
Documentation ensures employees know the approved process, and they’re less likely to improvise.
For businesses already reviewing their IT processes, this connects naturally to IT documentation and standardization. Account recovery shouldn’t live in one person’s head or change depending on who answers the request.
Give Employees a Safe Way to Challenge Requests
Employees need clear language they can use when something feels off.
A suspicious request is easier to challenge when the business has already made verification part of the culture. Employees shouldn’t feel rude, slow, or unhelpful for pausing a request involving account access, payment changes, passwords, MFA codes, or sensitive data.
Useful responses can be simple:
- “I need to verify this through our normal process.”
- “I cannot share passwords or verification codes.”
- “I will call back using the approved contact information.”
- “Please submit this through the usual support channel.”
These responses give employees a way to slow down the interaction without escalating the conversation unnecessarily.
Leadership support is important. If managers expect employees to move quickly, security procedures are easier to bypass. If leaders reinforce the importance of verification, employees are more likely to follow the process when pressure is high.
Make Vendor and IT Support Requests Easier to Verify
Vendor impersonation can be especially difficult because many businesses rely on outside providers.
Attackers pretend to be an IT vendor, software provider, telecom company, bank, payment processor, or managed service provider. They reference a real product, support ticket, renewal, or account issue to make the request feel credible.
Keep a current list of approved vendors, known contacts, support numbers, contract owners, and escalation paths. Your team should have clear communication expectations. Employees need to be aware of who is allowed to approve vendor changes, payment updates, remote access, and account modifications.
If your IT provider will never ask for passwords over the phone or support requests are required to go through a ticketing system, employees should know. If urgent vendor requests need manager review, the process should be documented before someone tries to bypass it.
For businesses using Microsoft 365, account access, Teams messages, file permissions, MFA settings, and administrative controls should be reviewed as part of the broader security environment.
Review the Process Before an Impersonator Tests It
The best time to review account recovery is before someone tries to exploit it. Business leaders can start with a few simple questions:
- How are password resets approved?
- How are MFA changes handled?
- Who can grant access to sensitive systems?
- How do employees verify urgent IT or vendor requests?
- Where are recovery processes documented?
- Who approves exceptions?
- Where should suspicious calls, texts, or messages be reported?
These questions reveal whether the business has a repeatable process or relies too heavily on memory, trust, and informal communication.
A review identifies where stronger controls are needed. Some accounts may need phishing-resistant MFA. Some admin permissions may need to be reduced. Some vendors may need clearer approval paths. Some employees may need better guidance on what to do when a request feels urgent but unusual.
Build Verification into Everyday Security
Social engineering attacks succeed when people are pressured into acting before they verify.
Better verification procedures make those attacks harder to push through. Employees know when to pause. Help desks know which steps to follow. Managers know when approval is needed. Vendors know which channels to use. The business has a clearer way to protect accounts without turning every request into a roadblock.
For Okanagan SMBs, this is an important part of modern cybersecurity. Suspicious links are still a concern, but account recovery, MFA resets, vendor requests, and support processes deserve the same level of attention.
Not sure whether your current account-recovery and verification processes would stop an impersonator? Talk to Carpathia IT about reviewing your security environment.