Understand the decision

When someone claims to represent a service provider, check the request through the provider’s established support route. Do not use a phone number or login link supplied only in the unexpected message as the sole verification. Ask what issue is being addressed and whether there is a ticket you can inspect independently. Keep passwords and one-time verification codes out of the conversation. A legitimate need for help does not remove the need to know who is asking.

A practical workflow

Give staff a short escalation routine: pause, preserve the message, contact the account owner and verify through the service. Explain what information they may share once the request is confirmed, and which information requires a different approved process. If an issue affects a public profile or payment-related link, the urgency can make people skip checks. Build the verification step into the incident plan so it is normal even when the team is under pressure to restore a service.

Imagine this

Hypothetical example

A caller says a company profile will be suspended unless an administrator supplies a code. The administrator does not provide it. They open the service’s official support channel and ask about the claimed issue, allowing the team to resolve any real problem without trusting the unsolicited caller.

Make it practical.

Use this checklist as you read. Checks are not stored.

References & further reading

Further reading: CISA: Secure Our World ↗

Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.