Gartner reports deepfake social engineering during employee calls.
AI voice cloning can make a support caller sound familiar. Fctr helps employees verify IT and helpdesks verify employees before sensitive actions.
Read articleIdentity threats.Practical guidance.
Research and practical guidance for caller verification, account recovery, and sensitive identity support operations.
Follow the Fctr Blog
More from Fctr.
Threat briefs, technical explainers, and guidance for your team.
A Microsoft Teams call is not proof that the caller is IT.
A familiar Teams call can become an attacker's remote session. Verify the person before granting access.
A Practical Guide to IT Caller Verification
How to check that employees can verify support callers—and know what to do when verification fails.
Introducing Netra: an AI agent for Microsoft Entra ID
Get answers about your Microsoft Entra ID tenant—just ask in plain English.
IT caller verification: a takeaway from Okta Threat Intelligence.
A request to fix a security key can become a request to use weaker authentication. Verify the IT caller before following their instructions.
ClickFix and fake IT support: before you run the fix.
Employees should not have to inspect a script to decide whether the person asking them to run it is really IT.
Microsoft Entra Verified ID was built for identity verification.
Authentication factors help establish account control. Verified ID lets an employee present trusted identity evidence when a workflow needs to verify who they are.
The signals looked legitimate. The person was not verified.
A real prompt, a Microsoft Teams message, or Microsoft-hosted infrastructure can still be part of an attacker-directed support interaction.
Email bombing creates the crisis. Fake IT support arrives with the fix.
An inbox flood makes the employee want help. Attackers exploit that moment by impersonating IT and offering remote support.
UNC6671 is calling employees at financial firms and posing as IT.
Mandiant says the callers reach personal phones, spoof helpdesk numbers, and use urgent passkey or MFA changes to move employees into attacker-controlled flows.
The unlock button should come after verification.
Provider permissions determine who can unlock an account. They do not verify the employee asking for that action on the phone.
The sign-in page was real. The caller wasn't.
A request to update a passkey can be the pretext for device-code phishing. A real sign-in page does not verify the IT caller.
Your mother's maiden name is not verification.
A caller knowing personal details does not prove that the person on the line controls an organization-managed authenticator.
Put verification
into the conversation.
See how Fctr helps helpdesks verify employees and employees verify callers and colleagues.