Imagine receiving a call from someone who says they are from IT support. They know your company, sound helpful and explain that your account needs an urgent security update. They offer to stay on the line while you complete it.
Before following their instructions, how would you check who they really are?
That question sits at the heart of social engineering: manipulating people into sharing information or granting access. Two recent cases, one at Canadian law firms and one at a global cryptocurrency exchange, show how convincing these approaches have become and what any business can do about them.
When the caller claims to be IT support
On 30 October, the Alberta Lawyers Indemnity Association warned that several law-firm employees had fallen victim to callers impersonating IT support.
The callers said urgent action was needed: a password reset, enrolment in multi-factor authentication or a security update. A Canadian Cyber Centre alert issued two days earlier describes the same campaign targeting the legal and financial sectors. Callers may fake a genuine help-desk number and call office phones, mobiles or Microsoft Teams. Victims are then guided to a fake sign-in page that passes their password and sign-in approval straight to the real service, giving the criminals access.
This is voice phishing, sometimes called vishing. A familiar-looking number, company branding or a Teams call does not prove who is contacting you.
It doesn’t always start with a phone call
On 29 October 2026, cryptocurrency exchange Binance lost about US$6.34 billion in digital assets. The FBI has attributed the theft to North Korea.
According to Binance’s initial findings, one engineer was approached through a legitimate job-hunting platform. The supposed employer held interviews, including a live video call, and shared a social media profile to build trust. The engineer was then asked to download an interview “assignment” onto his work computer. It contained malicious code.
The investigation also describes an earlier malicious software download that exposed information about staff. Binance says it replaced the affected device and changed the credentials. In the later attack, criminals spread from the interview victim’s computer to other engineers’ systems, stole access credentials and reached the service that signs crypto transfers.
The investigation is continuing, and these are separate incidents. There is no established connection between the Canadian campaign and the North Korean attribution for Binance. The common thread is that a credible conversation led to an unsafe action on a computer that already had trusted access.
Why social engineering matters to your business
Your business may hold client records, contracts, payroll information or confidential correspondence. Access to one employee’s account can expose whatever that account is allowed to see.
The request might sound routine: install a meeting application, complete a security check or let someone help remotely. Those actions can be legitimate. The risk is carrying them out for someone whose identity and request have not been checked independently.
Five practical actions
- Pause before acting. An unexpected request to install software, change sign-in settings or grant access deserves a check, even when the caller sounds knowledgeable.
- Verify through a route you already trust. End the call and contact your IT provider using a number or support channel you already know. Do not rely on a number or link supplied by the caller, or call back the number that called you.
- Keep sign-in details private. Never share passwords or one-time codes with a caller. Reject sign-in approval requests you did not start. Open work services the way you normally do, not through a link sent during the call. Our earlier brief on unexpected MFA prompts explains why.
- Use the approved software process. Ask IT before installing unfamiliar applications, browser extensions or interview assignments on a work computer. Check unexpected requests before sharing your screen or allowing remote control.
- Report concerns immediately. If you have already clicked, installed something or approved access, tell IT what happened. Prompt reporting gives them a better chance to contain the problem.
A check for owners and managers
Make sure everyone knows how to verify an IT request and report a concern without fear of blame. Ask your provider to review account permissions, software installation controls and monitoring.
Multi-factor authentication remains important, but some methods resist phishing better than others. Ask whether phishing-resistant options, such as security keys or passkeys tied to a specific device, are appropriate for your team. Primeworks can help review your Microsoft 365 account and device security.
Frequently asked questions
What is social engineering?
Social engineering is when criminals manipulate people into handing over access, information or money, instead of breaking in through technology alone. Fake support calls, fake recruiters and urgent emails are common examples.
Does multi-factor authentication still help?
Yes. It blocks many attacks. But codes and approval prompts can be passed on to criminals if someone is talked into sharing or approving them. Phishing-resistant methods, such as security keys, are much harder to misuse this way.
What should I do if I have already shared a code or approved a request?
Tell your IT provider straight away. They can end active sessions, reset access and check what the account was used for. A password change on its own may not be enough.
Pause. Verify. Report. A convincing conversation should never replace an independent check.
Existing customers can log a support ticket by emailing support@primeworks.co.za. For a first conversation about your business, request a security review.