TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and fraudulent transfers.
This pattern of fraud relies on impersonation rather than technical exploitation. Attackers pose as representatives of a bank, insurer, or healthcare provider and reach out by phone with what sounds like a routine security check. The caller asks the target to confirm personal details, share a one-time passcode, or reset account credentials. In a related scenario, a caller impersonating a legitimate company representative asks a customer or accounts payable staff member to redirect an upcoming payment. Both variants depend on the victim trusting the caller's claimed identity rather than verifying it independently.
The scams work because criminals disguise the sender's identity and exploit the organization's reputation to encourage a response. A call that references a familiar institution, phrased as routine security procedure, lowers suspicion at exactly the moment a target should be most cautious. Findings indicate that most suspected digital fraud activity occurs during account logins and financial transactions, meaning attackers are timing these contacts to coincide with moments when a security request would not seem out of place. Account recovery and secondary authentication steps are also targeted, since attackers increasingly seek to exploit these processes as login controls get stronger elsewhere.
Following caller instructions in these scenarios can help an attacker take over an account or authorize a fraudulent transfer, so verification habits matter more than recognizing a brand name. Teams and customers should:
These habits address the underlying weakness in this type of scam: it relies on the target accepting a claimed identity at face value during a moment framed as routine.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Criminals disguise the sender's identity and exploit the organization's reputation to encourage a response, often opening with what sounds like a routine security procedure from a bank, insurer, or healthcare provider.
Never share a one-time passcode with an unsolicited caller or message sender. Hang up and independently contact the organization using a trusted phone number or official app.
Fraudsters may impersonate legitimate representatives to persuade customers or staff to redirect payments, which can lead to authorizing a fraudulent transfer. Unexpected redirection requests should be verified through a known, independent channel before any changes are made.
As businesses strengthen login controls, attackers increasingly seek to exploit secondary authentication and account recovery processes to gain access to accounts, making these workflows a point of extra scrutiny.
Your bank calls about a routine security check. Sounds helpful, right? The caller knows your name and asks you to confirm details, reset your password, then read out the one-time code your bank just texted. Here's the trick: they may have your leaked details, but they don't have that code. Give it to them, and they can get into your account. Unexpected security call? Hang up and call the number on your bank card yourself.
UK authorities said two Scattered Spider members accessed Transport for London (TfL) by buying partial employee credentials and then tricking TfL’s helpdesk into resetting an employee password and 2FA. The attackers kept access for several days, escalated privileges, and ultimately exposed customer…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Microsoft reports an active campaign where attackers pose as IT helpdesk staff and pressure employees to “update or enroll” passkeys, MFA, or SSO. Victims are pushed to either a fake Microsoft sign-in page (AiTM phishing) or a real Microsoft device-code flow, resulting in attackers gaining…
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
