01 / PRESSURE
“Do this right now.”
Deadlines, threats and urgency can be used to keep you from getting a second opinion.
A SILVER TEAM TEACHABLE MOMENT // VISHING AWARENESS
Remember_
you were being
taught not tested!
What matters isn't whether the diagnostic page seemed convincing. It's what you recognize now and what you'll do the next time someone asks you to trust an unexpected request.
01 / WHAT JUST HAPPENED
A convincing page or voice isn't proof of identity.
Your browser displayed a legitimate-looking network diagnostics page. An attacker could use a similar page or a telephone conversation to make a request feel routine, familiar, or urgent.
Vishing (voice phishing) uses calls, voicemails, and voice-enabled systems to manipulate people into disclosing information, approving access, installing software, or changing financial details.
You are allowed to question a caller politely, even when they know internal names, use technical language, or appear to be a senior employee.
WHAT THE DEMO ACTUALLY KNEW
The network page showed the public IP and User-Agent that a server can normally see when your browser requests a page. It did not prove your employer, position, identity, or authorization. The ACME and Jon Doe names were part of the fictional demonstration.
02 / EARLY WARNING SIGNALS
Watch the request.
Don't rely on the story.
A single detail is rarely decisive. If a request violates your organization's process, verify it through a channel you already trust.
02 / SECRETS
“Read me your code.”
Unexpected requests for credentials, MFA codes and PINs are serious warning signs.
03 / DEVICE ACCESS
“Install this fix.”
Remote-access tools, screen sharing and unsolicited security changes all need independent confirmation.
04 / AUTHORITY
“I am from IT.”
A known department, executive title or support-ticket number doesn't authenticate a caller.
05 / CALLER ID
“Check my number.”
A displayed number or local area code can be spoofed.
06 / SECRECY
“Don't tell anyone.”
Instructions to avoid ordinary reporting and approvals are reasons to stop and verify.
03 / YOUR RESPONSE PLAYBOOK
Four actions.
One reliable habit.
01
Recognize the unusual request
Notice urgency, unexpected account changes, requests for access, one-time codes, money transfers or exceptions to policy.
02
Politely decline and end the call
There is no need to accuse the person or debate whether they're genuine. You can simply refuse to proceed until you've independently checked.
03
Verify through your own channel
Use an internal directory, trusted bookmark, approved help-desk portal, or established company number — not a link or callback number supplied in the suspicious interaction.
04
Report promptly
Tell your security team, help desk, or manager what happened. Capture the claimed identity, time and requested action when practical.
WORDS YOU CAN USE
“Thanks for letting me know. I'll verify the request through our official help desk and contact you through the approved process.”
04 / RECOGNIZE THE PATTERNS
Different stories.
The same underlying technique.
Expand a scenario to see how it works and how to respond safely.
🛠️ Fake IT help desk or tech support+
The approach: Someone claims there's an outage or infected device and asks for a code, password, installation, or remote session.
Your defense: Confirm the technician and ticket through your official help desk, not through the caller's link or number.
🏦 Bank or payment fraud department+
The approach: A supposed fraud agent pressures you to move funds to a “safe” account or read out a verification code.
Your defense: End the conversation and contact the bank through its app or a trusted number from your card.
👔 Executive, supplier or manager+
The approach: A familiar name or title is paired with an urgent request for a payment, private document or approval exception.
Your defense: Follow established independent verification and dual-approval procedures.
🎙️ AI-cloned or familiar-sounding voice+
The approach: A caller sounds like somebody you know and describes an emergency.
Your defense: Don't authenticate people by voice alone. Contact them using an existing trusted channel.
☎️ Spoofed caller ID and callback traps+
The approach: An official-looking number, local area code or voicemail message urges you to call back or press a key.
Your defense: Find the organization independently. Don't rely on the displayed number or provided callback.
🔑 MFA codes and account recovery+
The approach: Somebody claims to be security and requests a sign-in code or unexpected MFA approval.
Your defense: Never share the code or approve an unexpected prompt. Report it to the security team.
⚖️ Government, delivery or benefit calls+
The approach: Threats about fines, arrests, parcels or benefits are used to demand payment or private data.
Your defense: Contact the agency using an independently verified published channel. Don't let threats bypass your safeguards.
💬 Calls mixed with email, SMS or QR codes+
The approach: A caller asks you to click a link, scan a QR code, or join a meeting that supports their claimed identity.
Your defense: Verify the request before opening an untrusted link, scanning a code or joining a session.
05 / IF YOU ALREADY ENGAGED
Recovery is a defender win, too.
Shared a password or code?
Contact IT/security immediately, change credentials through a verified channel and request a session review.
Installed software or shared control?
Stop the session and ask your official help desk how to secure and inspect the device. Preserve evidence.
Sent funds or financial details?
Contact your bank immediately through a verified number to discuss stopping or reversing the transaction.
Report early, even if you're uncertain. Your report may help protect coworkers.
06 / TRY ONE DECISION
What would you do?
No score, tracking, or gotchas. Just one chance to practice a safe response.
PRACTICE SCENARIO
A caller says they're from your IT team, knows your manager's name, and says your account will be locked in five minutes unless you give them the sign-in code you just received. What's the best next step?
07 / FOR YOUR TEAM
Make safe choices the easy choices.
For employees
- Keep trusted support contacts accessible.
- Never read sign-in codes to an unexpected caller.
- Independently verify sensitive requests.
- Report without embarrassment or delay.
For leaders and defenders
- Authorize staff to challenge suspicious requests.
- Provide clear verification channels.
- Require independent approval for risky changes.
- Reward reporting and early recovery.
THE SILVER TEAM APPROACH
It's about EDUCATION,
not exploitation.
Better awareness starts with respect, useful practice, and the confidence to question unusual requests.
EVERY TEACHABLE MOMENT SHOULD HAVE A SILVER LINING.FURTHER READING
For additional guidance, see FTC: Phone Scams ↗ and CISA: Recognize and Report Phishing ↗.