 |
| AI-generated illustrative image; not a photograph of an actual event. |
Your phone rings during a busy workday. The caller says they’re from the IT help desk, knows your employer’s name and says you need to register a passkey before your account is locked. The request sounds routine. The deadline sounds urgent. And the safest next move is to stop and check who is actually calling.
That scenario is hypothetical, but the tactic is real. In an October 28, 2026 alert, the Canadian Centre for Cyber Security warned about an ongoing voice-phishing campaign targeting Canadian organizations. The attackers pose as internal IT staff and direct employees to fraudulent sign-in pages. Here’s what workers need to know without getting lost in security jargon.
What is the fake IT support scam?
Voice phishing, often called “vishing,” uses a phone call or another voice channel to persuade someone to share information or take an action that gives an attacker access. In the campaign described by the Cyber Centre, callers have claimed an urgent passkey migration, multi-factor authentication (MFA) enrolment or password change is required.
The agency says calls may reach personal mobiles, office phones or Microsoft Teams. Caller ID can be spoofed to resemble a real help-desk number. A caller might mention an internal IT employee or a supposedly missed deadline to sound convincing. Some may hang up if the employee tries to verify the request independently.
The reported campaign targets organizations, including those in the legal and financial sectors. The Cyber Centre says related infrastructure has named Canadian organizations since January and that activity in October was concentrated on the legal sector. Its alert does not mean every Canadian employer has been attacked, and it does not identify every potential target.
Why a convincing sign-in page isn’t proof
The caller may send a worker to an organization-branded page on a lookalike domain. A familiar logo or company name in an address can make the page feel official, even when the underlying site is controlled by someone else.
In the scheme described by the Cyber Centre, a fraudulent page can relay a person’s credentials and MFA responses to the legitimate identity provider in real time. That can give the attacker an authenticated session. It is a reminder that an extra security step is valuable, but the context in which you approve it matters too.
In some reported cases after access was obtained, attackers registered their own authentication methods or devices, accessed cloud services and stole data. Those are reported possibilities, not a claim that every suspicious call led to a breach.
Are passkeys unsafe?
No. A scam that talks about passkeys is not evidence that a genuine passkey was copied or broken. The Cyber Centre recommends phishing-resistant MFA, including appropriate FIDO2 security keys and device-bound passkeys, as a protection for organizations.
The trick is to impersonate the process around security changes. A criminal might say your passkey needs an urgent upgrade, then steer you into an unrelated fake sign-in or approval flow. Microsoft’s security researchers have also documented passkey-themed social engineering that led to compromised identities and cloud access.
Keep using your employer’s approved security tools. Just don’t let an unexpected caller decide where you sign in or what you authorize.
Five checks before you respond
1. End the call and start a fresh one. Contact your IT team through a number in your organization’s established directory or another trusted channel you already know. Don’t use a number the caller supplies or your phone’s callback button. The Cyber Centre gives the same advice in its vishing guide.
2. Treat caller ID as a clue, not identification. A real-looking phone number can be spoofed. A friendly voice, company jargon or a reference to a colleague doesn’t settle the question either.
3. Don’t hand over a password or one-time code. Be cautious of unexpected requests for credentials, MFA codes or sensitive information. If an approval prompt appears when you aren’t trying to sign in, don’t approve it; contact your security team through a trusted channel.
4. Open services the way you normally do. Instead of following an unexpected link or typing a website dictated over the phone, use your organization’s known portal or bookmark. If you are unsure about an enrolment request, ask IT to verify it first.
5. Report the attempt. Share the time, the number displayed and any website or message with your organization’s security team using its reporting process. Don’t forward suspicious material to coworkers as a warning; your team can decide how to investigate and alert others.
What if you already clicked or signed in?
Don’t wait for proof that something went wrong. Contact your IT or security team immediately through a trusted channel and explain exactly what happened: whether you opened a page, entered credentials, approved a prompt or installed software. Preserve relevant messages and follow the team’s instructions; they may need to investigate the account and device.
The Cyber Centre recommends actions such as revoking active sessions, resetting credentials and removing unauthorized authentication methods when compromise is suspected. Those steps should be coordinated with your organization’s responders. Its social-engineering guidance also recommends contacting your bank if you shared banking or payment information.
A password change can be an important part of recovery, but it may not be the whole job. An attacker-controlled authentication method or active session can require separate attention. Tell the response team about every prompt you approved, even if it felt like an ordinary login at the time.
A simple rule for a stressful moment
Imagine your real help desk is rolling out a new login method. There may be a genuine deadline, and the work may be legitimate. You can still pause, close the unexpected message or end the call, and verify the change through the channel you normally use. A short independent check gives you useful information without putting the caller in charge of the process.
The Cyber Centre’s alert is a timely reminder that digital security is not just about spotting strange-looking websites. Sometimes the first warning sign is a perfectly ordinary conversation that suddenly asks you to hurry.