An employee receives a phone call from someone claiming to be the IT help desk, who says the user's account is being migrated and asks them to read out the six-digit code that just arrived on their phone. Which attack is this, and which policy best counters it?
Select an answer to reveal the explanation.
Short Explanation
Your MFA code is like the key to your car — the valet never needs it read aloud over the phone. That call is vishing, voice phishing aimed at the one thing your stolen password was missing. The fix is a simple, well-known rule: IT never asks for codes, so you hang up and report.
Full Explanation
Vishing is social engineering by voice. In this pattern the attacker already holds the password, often from earlier phishing, triggers a login that sends a one-time code, and calls the user while posing as IT to obtain it. Reading the code aloud completes the attacker's sign-in. The effective counter is a clear, widely communicated policy that IT staff never request authentication codes, reinforced by training that tells users to end the call and report it through a known channel; phishing-resistant MFA further removes the code from the process entirely. Smishing is phishing delivered by text message, and the code here arrived as a legitimate message that the attacker requested; blocking short codes would break genuine MFA without stopping the phone call. Credential stuffing replays leaked username and password pairs across services, and unique passwords address that, but this attack obtains the second factor through deception. Pharming redirects users to fraudulent sites through DNS or host-file manipulation, and no redirection occurred. Exam caveat: MFA fatigue attacks are a related variant that floods users with push requests until one is approved. Operational check: confirm the help desk script never asks for codes, publish that rule, and review sign-in logs for logins following reported calls.