When the Person Helping You Set Up MFA Isn’t Really From IT

An employee receives a call from someone claiming to be the company's IT support team.

There is a security update that needs attention. The caller explains that the employee's account requires a new authentication setup and offers to walk them through the process.

It sounds like a routine technology request.

The employee may already be familiar with multifactor authentication, commonly called MFA. They have probably been told that approving security prompts, registering authentication methods, and following IT instructions are important parts of protecting company information.

So why would this particular request seem suspicious?

That question sits at the center of a growing cybersecurity problem: attackers are finding ways to make fraudulent instructions look like legitimate security procedures.

When Following Instructions Becomes the Risk

This is not simply a hypothetical concern.

In a 2026 advisory, the Canadian Centre for Cyber Security described incidents in which attackers manipulated support personnel into resetting MFA or registering devices controlled by attackers.

The advisory highlighted a troubling weakness. Attackers were not necessarily exploiting sophisticated software vulnerabilities. They were exploiting the trust businesses place in their identity verification and support processes.

Consider what that means for a smaller organization.

An employee might receive a message about an account problem, a required security update, or a new login procedure. The person contacting them may sound knowledgeable and use terminology that employees regularly hear from legitimate IT support.

The employee's intention is to cooperate.

The attacker wants that cooperation to result in unauthorized access.

The problem is not that employees are unwilling to follow security procedures. It is that criminals can imitate those procedures.

This is why everyday employee habits affect business security in ways that go beyond recognizing suspicious emails. Employees also need to understand how to verify unexpected requests involving their accounts and access.

Why MFA Alone Cannot Solve This Problem

MFA remains an important protection for business accounts.

Requiring additional verification beyond a password makes unauthorized access more difficult. Stronger authentication methods, particularly phishing-resistant options, can provide significantly better protection against common credential theft techniques.

But authentication technology is only one part of the process.

Businesses also need procedures for enrolling devices, resetting authentication methods, recovering locked accounts, and helping employees who cannot sign in.

Those activities sometimes require human assistance.

And that creates opportunities for manipulation.

An attacker might persuade someone to approve an unexpected authentication request, disclose a verification code, or initiate a fraudulent account recovery process.

In other cases, the attacker may target the help desk itself, attempting to convince support personnel to register an unauthorized authentication method.

These are different techniques, but they expose the same operational weakness: the organization may not have a reliable way to verify who is requesting or authorizing an account change.

The Business Impact Goes Beyond One Employee

A compromised account is rarely just an isolated technical issue.

Depending on the employee's permissions, an unauthorized person might gain access to company email, shared documents, customer information, or internal business applications.

This also raises a broader question about who really has access to your business information. Understanding account permissions and reviewing access regularly can help businesses recognize the potential consequences when an employee account is compromised.

That access can create further problems.

A business may need to investigate suspicious activity, review account permissions, revoke unauthorized sessions, and determine whether information was accessed or changed.

Employees may temporarily lose access to systems while the situation is investigated.

If the compromised account belongs to someone responsible for finance, administration, or sensitive customer relationships, the disruption could become particularly significant.

The consequences depend on what the account can access and what the attacker actually does.

But even without a confirmed data breach, uncertainty about account integrity can interrupt normal operations.

For business owners, this raises a practical question:

Would your company know what to do if an employee reported that someone claiming to be IT had asked them to change their authentication settings?

Employees Need a Way to Verify IT Requests

Security awareness training often tells employees not to click suspicious links or share passwords.

That advice still matters, but it does not fully address attacks that arrive through phone calls, account recovery requests, or convincing security instructions.

Employees need a clear process for handling unexpected IT communications.

That process does not have to be complicated.

A few practical safeguards can make a meaningful difference:

• Use a known support channel. Employees should independently contact IT using an established phone number, portal, or other approved method rather than relying on contact details supplied in an unexpected message.
• Communicate planned security changes. When authentication procedures are changing, employees should know what to expect and where to verify the instructions.
• Control authentication resets. IT support should follow documented identity verification procedures before resetting MFA or enrolling replacement devices.
• Review authentication changes. Unexpected registrations, recovery changes, and unusual sign-in activity should receive appropriate attention.
• Encourage reporting without embarrassment. Employees should feel comfortable questioning a request, even when it appears to come from someone in authority.
  

These measures help employees make better decisions without expecting them to become cybersecurity specialists.

They also help legitimate IT teams provide consistent support.

A Practical Way to Verify Who Is Calling

One way businesses can reduce IT support impersonation is to give employees a simple method of verifying whether someone claiming to represent their organization has access to its current verification information.

At Nivo 5, we've implemented an organization-wide verification process using a unique security code that changes regularly.

When an employee receives an unexpected call from someone claiming to be part of our IT team, the employee can challenge the caller to provide the current code. The employee independently compares that response with the code available through their own authorized security environment.

A matching code provides an additional indication that the caller has access to the organization's current verification information. It makes impersonation more difficult without requiring employees to recognize every IT representative by voice or remember individual contact details.

This is not a substitute for confirming someone's identity and authority before making sensitive account changes. A shared code could be disclosed or compromised, so MFA resets, account recovery, and permission changes still require appropriate safeguards.

The important principle is straightforward: employees should have a practical way to challenge unexpected IT requests rather than being expected to trust the person making them.

For business owners, this illustrates how a relatively simple operational control can strengthen the human side of cybersecurity.

The Question Businesses Should Be Asking

There is an important distinction between teaching employees to use security tools and teaching them how to recognize legitimate security instructions.

Businesses need both.

A company can invest in stronger authentication, require MFA across its applications, and still leave employees uncertain about who is authorized to request changes.

That uncertainty deserves attention.

A useful starting point is to ask employees and IT support the same question:

If someone contacts an employee tomorrow and says their authentication settings must be changed immediately, how would the employee verify that request?

If the answer depends entirely on recognizing a familiar voice, trusting a convincing message, or assuming the caller knows what they are doing, the process may need improvement.

The goal is not to make employees suspicious of every legitimate IT interaction.

It is to give them a dependable way to distinguish authorized support from impersonation.

Because sometimes the most important security decision an employee makes is not whether to approve an authentication request.

It is whether the person asking them to approve it can be trusted.

At Nivo 5, we believe practical cybersecurity should help businesses maintain reliable operations while keeping access to important information under control. If your organization is reviewing how employees receive IT support or how authentication changes are handled, those processes are worth examining before a suspicious request creates a larger problem.