Hold, Please. It's a Phish!

Imagine your phone rings, and it is someone claiming to be from your organization's IT support team. The call may seem to come from a co-worker you know, and it might reach you on a personal device. Because a request from IT can feel routine, you may be tempted to respond right away.

But this call is actually a scam, known as vishing, or voice phishing. Extortion groups, such as ShinyHunters, use these calls to persuade you to perform a familiar action, such as approving an authentication request or entering a device code. If you complete the action, cybercriminals can steal your login information or register their own devices and authentication methods. They can also potentially retain access to your account after you reset the password, that's why it's important to sign out of all devices when you change your login credentials. 

Follow these tips to avoid falling victim to vishing:

• Verify any unexpected requests through an established channel, not the number that contacted you.
• Never approve or put login information into an authentication request unless you initiated the request yourself.
• Always stop and think before you act, even when the call seems to come from a person or organization you trust.