Before an employee follows an unexpected IT support call about changing multi-factor authentication (MFA), they should be able to confirm the change through an established company channel they open themselves. For the IT manager planning an MFA rollout, that means publishing a verifiable enrollment route before asking people to act.
The reason is immediate. In an October 28, 2026 alert, the Canadian Centre for Cyber Security describes callers impersonating internal IT staff and directing employees to fraudulent sign-in pages. The reported targets include Canadian legal and financial organizations. The alert covers an ongoing campaign during 2026; October 28 is its publication date, not the beginning of the attacks.
When a security upgrade becomes the lure
The callers use urgent MFA or passkey-enrollment stories. A passkey is a cryptographic sign-in credential; using that term does not authenticate the caller. The fraudulent page relays passwords and conventional MFA responses to the real sign-in service, obtaining an authenticated session.
In a hypothetical rollout, an employee expecting an account upgrade receives an enrollment link from an unexpected caller. The task sounds like cooperation with security. The employee needs a way to confirm the real project independently.
The Cyber Centre's separate voice-phishing guidance recommends ending suspicious calls and contacting the organization through a known, trusted route. Caller ID can be spoofed. A number supplied during the call, or the phone's callback button, does not provide that independent route.
Rewrite the real rollout announcement
Consider two invented announcements for the same legitimate MFA project. They illustrate a communication decision an IT manager can make before launch.
An announcement that asks employees to trust the incoming contact:
IT will call this week to finish your MFA upgrade. Follow the enrollment link the technician sends so your access is not interrupted.
This makes the call itself the starting point for trust. An employee who follows the announcement has little reason to question a stranger using the same story. Adding a company logo or the name of a real technician would not change that problem.
A verifiable version, for an organization with an established employee portal:
Our MFA upgrade instructions are in the employee portal you normally use, under IT Notices. Open that portal through your existing bookmark to confirm your rollout group, deadline, and enrollment steps. If someone calls about the upgrade, you may end the call and contact the help desk through the company directory. Do not give a caller your password or one-time sign-in code.
The second version gives employees a place to confirm the work independently. In this hypothetical rollout, the portal record identifies the affected group and approved steps; the directory supplies the support route. A caller cannot change those instructions simply by announcing a new deadline.
This wording must match the organization's actual tools. Publish the notice first, confirm ordinary employees can reach it, and brief support staff to welcome independent verification. For people who cannot access the portal, provide an already-established support route and the approved recovery process. Do not invent an exception during the suspicious call.
Make the verification route part of training
Our recommendation is to test the announcement with a small group before sending it widely. Ask participants to find the genuine notice and explain where they would confirm an unexpected enrollment request. If they cannot find the route, improve the instructions before judging their vigilance.
Network Box USA's Managed Security Awareness Training combines practical education, targeted learning, phishing simulations, campaign operations, and progress reporting. The program addresses impersonation and credential requests across email, phone, and messaging. That supports teaching the verification decision and following up where people struggle. Agree the lesson and exercise format with the training team; a live voice-phishing simulation is not assumed to be included.
Keep the authentication upgrade moving
A fake passkey-enrollment call is not evidence that passkeys themselves have been broken. NIST's authentication guidance explains why manually entered one-time codes are not phishing-resistant: an impostor can relay them. Fast Identity Online 2 (FIDO2) authentication using the Web Authentication (WebAuthn) standard can instead bind authentication to the legitimate service's domain.
The practical response is to secure the rollout and enrollment process while adopting the appropriate authentication controls. Your identity administrator owns that configuration, including recovery and permitted fallback methods. For requests to replace a lost factor, our help-desk MFA recovery guide addresses the separate decision about verifying the person requesting access.
If an employee already signed in
Ask the employee to report promptly through the known support channel, without revisiting the suspect site. The October 28 alert's response guidance calls for revoking active sessions and tokens, resetting credentials, removing unauthorized MFA methods or devices, reviewing account activity, and preserving relevant audit logs. Route the report to your authorized identity and incident-response teams.
Before the next MFA announcement, have an employee demonstrate how they would verify it without trusting an incoming call. To discuss managed awareness training around that decision, contact our team.