A call from IT

It was a typical Wednesday morning for Sarah. She had just finished her second cup of coffee and was settling into her workday when her phone rang. The caller ID displayed “IT Support,” so she answered without hesitation.

“Hello, this is Sarah,” she said.

“Good morning, Sarah. This is Mark from the IT team. We’ve detected that your current password is insecure and needs to be updated immediately to protect your account,” the voice on the other end said, sounding professional and reassuring.

Sarah was a bit surprised. She hadn’t received any emails about a password change, but with all the recent security breaches in the news, she didn’t want to take any chances.

“Okay, what do I need to do?” she asked.

“First, please open your computer and go to the company’s password management portal,” Mark instructed.

Sarah followed the steps, navigating to the familiar login page. “Alright, I’m there,” she confirmed.

“Great. Now, instead of logging in, click on the ‘Forgot Password’ link. This will allow us to reset your password securely,” Mark continued.

Sarah clicked the link and was prompted to enter her email address. She did so, and within moments, she received a password reset email.

“Open the email and click on the reset link,” Mark said.

Sarah did as instructed, and a new page opened, asking her to enter a new password. “What should I use for my new password?” she asked.

“Make sure it’s something strong. Use a mix of upper and lower case letters, numbers, and special characters. Avoid using common words or phrases,” Mark advised.

Sarah thought for a moment and then typed in a new, complex password. “Okay, I’ve updated it,” she said.

“Excellent. Now, log in with your new password to confirm everything is working,” Mark said.

Sarah logged in successfully. “It worked. Thank you, Mark,” she said, feeling relieved.

“You’re welcome, Sarah. Have a great day,” Mark replied before hanging up.

Later that day, Sarah mentioned the call to her colleague, who looked concerned. “We don’t have anyone named Mark in our IT team,” her colleague said.

A chill ran down Sarah’s spine. She immediately contacted the real IT department and explained what had happened. They quickly investigated and found that her account had been accessed by an unknown party shortly after she changed her password.

Fortunately, the IT team acted swiftly to secure her account and prevent any further unauthorized access. Sarah learned a valuable lesson that day: always verify the identity of the person on the other end of the line, even if they seem legitimate.