The Canadian Centre for Cyber Security published alert AL26-028 on Oct. 28, warning of an ongoing voice phishing campaign targeting Canadian organizations. The attackers do not breach a system. They telephone the help desk, impersonate an employee, and talk their way into a password reset or a change to multi-factor authentication.
Once that reset lands, the attacker holds the keys legitimately. Every control downstream sees an authorized user doing authorized things. It is the human version of an unlocked side door — except the door was opened by someone trying to be helpful.
The timing fits the pattern Statistics Canada reported this week: scams and fraud were the leading category in the 2025 cyber incident data, ahead of ransomware. For many organizations, the front door of an incident is now a conversation.
Your firewall cannot hear a phone call. The help desk has become part of the security perimeter — and it has to be defended like it.
Defending a help desk is procedure, not product. Verify identity through a channel the caller does not control. Call back on the number listed in the directory, never a number the caller provides. And give agents explicit permission to slow down or refuse a rushed reset, especially one wrapped in urgency — urgency is the tell.
This week, ask your help desk one question: what stops a convincing stranger from resetting my password? If the honest answer is “we would probably notice,” write the callback procedure down and rehearse it before someone tests it for real.