Phishing attacks do not always start with a suspicious email or a strange link. Sometimes, they start with just a phone call.
We recently saw a situation involving someone at an organization we support that shows just how convincing a modern social engineering attack can be. We are leaving out identifying details, but the incident is worth sharing because the attacker did not use malware or a sophisticated technical exploit.
They convinced someone to let them in.
A Convincing Call From a Financial Institution
The individual received a phone call that appeared to be from a financial institution. The caller claimed there was suspicious activity on their accounts and created a sense of urgency to fix the problem. The caller then walked the individual through several steps using legitimate apps on their phone.
Believing they were working with the financial institution to stop fraud, the individual followed the instructions. In reality, the person on the phone was the attacker.
Within a short time, the attacker gained access to multiple financial accounts. On one investment account, they changed the phone number associated with the account, added another bank account, and added their own authenticator method.
Fortunately, the individual quickly realized something was off and contacted the financial institution directly on a trusted line. This reaction made it possible to quickly verify that the caller was, in fact, vishing (Voice Phishing) and the financial account was secured before any money was lost.
The Phone Wasn't Hacked
One of the most important parts of this incident is what did not happen. There was no indication that the phone had been compromised, no malware was discovered, and there was no malicious software or sophisticated exploit involved.
The attacker used social engineering to gain access. They created urgency, sounded legitimate, and guided the individual through normal security processes until they had the access they wanted.
That is why cybersecurity awareness training is still so important, even when a business already uses strong passwords, multi-factor authentication, endpoint protection, and other security tools.
How to Combat Social Engineering
If you receive an unexpected call from a bank, investment company, Microsoft, Apple, your IT provider, or another organization asking you to:
- Access an account
- Provide an MFA or security code
- Approve a login
- Install software
- Change account or security settings
Stop. Hang up. Call back.
Do not rely on caller ID alone, as Phone numbers can be spoofed, making a call appear to come from a legitimate organization. Instead, contact the company using a number you already trust, such as the number on the back of their business card, in the company's official app, on a statement, or on its official website. A legitimate organization will have no problem with you ending the call and independently verifying who you are speaking with.
Why Employee Cybersecurity Awareness Matters
The person involved in this incident had received cybersecurity awareness training and understood the risks of phishing and fraud; however, they still got caught in the middle of an attack. That does not mean the training failed. It shows how convincing these attacks can be and why cybersecurity education cannot be treated as a one-time conversation.
Attackers know businesses are using stronger passwords and multi-factor authentication. In response, many attacks now focus on getting employees to approve access, provide information, or make changes themselves. Regular phishing simulations and cybersecurity awareness training can help employees recognize those situations and build the habit of stopping and verifying before taking action.
Make Verification Part of Your Security Culture
Technology remains an important part of protecting your organization, but your employees also need a clear process for handling suspicious requests. One of the simplest habits you can build into your cybersecurity strategy is this:
When something feels unusual or unnecessarily urgent, stop and verify it independently.
If you are unsure whether a request is legitimate, contact your IT provider before continuing. Dresner Group helps Maryland businesses strengthen their cybersecurity through managed security services, employee awareness training, phishing simulations, risk assessments, and ongoing IT support.
If you would like to review your organization's cybersecurity protections or employee training, contact Dresner Group to start the conversation.
