What you say changes what the caller tries next and how the call ends.
An unexpected call about your account
You work on the payments team. A man calls to say that someone is taking over your login right now and that he needs your help to stop it.
He sounds calm, knows a few things about you and is in a hurry. You cannot see who is on the line, so all you have is what he says and what you say back.
You have not called IT today, and the official IT number is in the company directory. Answer him the way you would at your own desk.
You will hear the caller's voice, and the transcript is there if you would rather read along. Keys 1, 2 and 3 choose a reply.
AGrade for this call
None
Account exposure
Caller verification
What this call checked
What to do when a caller asks for a code
Hang up and call IT back on a number you already have, never on one the caller gives you. A real team never minds the check.
Never read out a one-time code or approve a push you did not start. IT will never ask for either.
Treat pressure as the warning sign. Urgency, authority and threats are there to make you skip the check.
If you do slip, report it at once. Security can then end the attacker's session and reset your login before he does any harm.