The Canadian Centre for Cyber Security is warning about an ongoing phone scam aimed at Canadian organizations: callers pretend to be your company’s IT help desk and talk you into handing over your login. Since July, the campaign has focused on finance and law firms, and in October mostly on law firms.

How the call goes

According to the Cyber Centre, the caller:

  • says there’s an urgent passkey migration, MFA enrolment or password change you need to do
  • may spoof your real help desk’s number, set a tight deadline, or drop the names of people you work with
  • sends you to a sign-in page that looks like your company’s, often with the company’s name in the web address

That page passes everything you type, including your MFA code, straight to the real sign-in system. The attacker ends up logged in as you. That’s why ordinary text or app codes don’t stop it.

What happens next

Once inside, the attackers may add their own MFA device to your account, delete the security emails that would warn you, reset passwords for other apps, and copy files out of Microsoft 365, SharePoint and OneDrive. Then they demand payment, the Cyber Centre says.

How to protect yourself

If you get the call: hang up, then call your IT team back on a number you already know, not one the caller gives you. Real IT staff won’t mind. Report the call to IT even if you didn’t fall for it.

If you run IT, the Cyber Centre recommends:

  • phishing-resistant MFA, such as FIDO2 security keys or passkeys tied to a device, at least for administrators. Fake sign-in pages can’t capture these.
  • stricter identity checks before anyone resets MFA, recovers an account or adds a new device
  • alerts for new MFA registrations, mass file downloads and deleted security emails
  • sign-ins only from managed devices, blocking commercial VPNs and hosting providers
  • a clear way for staff to report suspicious calls

Canadian organizations can report suspected activity to the Cyber Centre through its My Cyber Portal or at [email protected].

Why it matters: This scam works because it uses the help desk, the people you’re supposed to trust about passwords. One rule protects you: nobody legitimate needs you to sign in through a link they read out on a call. It follows the Cyber Centre’s warning this week about AI-assisted attacks, and the defences are the same.