When the 'IT Guy' Calls: Verifying Requests Before You Act

October 15th, 2027

The call sounds routine. The person on the other end says they are from IT, that there is a problem with the account, and that they need the password to fix it. They are calm, friendly, and slightly impatient. They know the company name and the name of the person they are calling.

This is one of the oldest social engineering tricks, and it still works because it uses the ordinary language of a support call. The defense is not technical. It is a simple rule: IT does not need your password, and requests should be verified through a channel you already trust.

What a Real Support Call Looks Like

A legitimate IT support person may ask for your username, the device you are using, the error message, and what you were doing when the problem started. They may ask you to approve a multi-factor prompt or install a support tool through an approved process.

A real support person should not ask for your password, a one-time code read aloud, or remote access to your computer without a ticket or a known process. If they do, the call is a red flag.

The Verification Rule

The rule is simple: end the call and call back on a number you already have. Use the help desk number from the company directory, the support line on the intranet, or the number on the IT provider's website. Do not use the number the caller gives you.

If the caller is legitimate, they will understand. A real support team would rather wait two minutes than have an employee give away a password. If the caller pressures you, threatens urgency, or says the callback will take too long, that is another reason to hang up.

Requests That Should Always Be Verified

Some requests deserve extra caution even when they appear to come from inside the company.

• Password resets that ask you to read back the current password or a one-time code.
• Remote access requests that arrive without a ticket or a scheduled appointment.
• Changes to payroll or bank details, even if the request appears to come from a manager.
• Gift card or wire transfer requests, especially with a deadline.
• Requests for client records, employee data, or tax forms.
• New software installs from a link or attachment in an unexpected message.

For each of these, use a second channel. Call the person on a known number, open the ticket system yourself, or ask a coworker to confirm through the normal process.

Why the Caller Sounds Convincing

Scammers do their homework. They may know the company's name, the names of employees, the software the office uses, and the name of the IT provider. They may have found the information on the website, social media, or an old invoice.

They also use the psychology of authority and urgency. A person who says they are from IT sounds like someone who is allowed to ask. A person who says the account will be locked in ten minutes creates pressure to skip the check. The combination is designed to make verification feel rude.

It is not rude. It is the process.

Make the Process Easy for Staff

Employees are more likely to follow a verification rule if the rule is short and the callback is easy. Put the help desk number in the company directory, on the intranet, and on a card at each desk. Tell staff that a call from IT will never require a password, and that they will not get in trouble for ending a suspicious call.

Give the help desk a way to confirm its identity. A ticket number, a callback from the known number, or a message through the company's chat system can all work. The point is to give the employee a simple way to check.

If Someone Gave Information Away

If an employee realizes they gave a password or approved a remote session, the response should be fast and calm. Change the password immediately, revoke the session if possible, and tell IT. Watch for unusual activity in the account and any connected systems. If the same password was used elsewhere, change it there too.

The worst outcome is silence. An employee who is afraid of being blamed will wait, and the attacker gets more time. Make it clear that reporting quickly is the right move.

A Culture of Verification

The strongest defense is a culture where verification is normal. The owner verifies a request. The office manager verifies a request. The new hire sees that everyone does it, so it does not feel like an accusation.

Complete Document Solutions helps Southern California businesses with cyber security and IT support, including help desk procedures and awareness training. If your team is not sure how to verify a support call, contact us and we can help you set a simple rule.