Help-desk phishing calls successfully harvest SMS one-time passcodes from city employees. Which authentication direction best reduces that risk where feasible?
Select an answer to reveal the explanation.
Short Explanation
If a fake help desk can sweet-talk the text-message code out of someone, SMS OTP is on thin ice. Move toward keys and platform authenticators that do not hand a code to a stranger on the phone.
Full Explanation
SMS one-time passcodes are transferable secrets: help-desk phishing, SIM swap, and SS7-style interception can harvest them even when users “meant” to authenticate to the city. Preferring phishing-resistant authenticators—FIDO2/WebAuthn security keys or comparable platform authenticators—binds the ceremony to the legitimate origin and eliminates codes that social engineers can request over the phone. Where operationally feasible for municipal staff, that direction materially reduces the attack the scenario describes.
Keeping SMS OTP and training only after each confirmed compromise accepts repeated preventable takeovers and treats awareness as a backstop for a weak factor. Switching everyone to knowledge-based questions about mother’s maiden name substitutes another phishable, often public, authenticator. Removing MFA entirely so phishers have fewer codes to request leaves password-only accounts—usually a worse outcome for city SSO.
Exam caveat: CISSP favors stronger authenticators when feasible; SMS MFA is better than nothing but is not phishing-resistant. Operational check: pilot FIDO2 for administrators and remote finance staff, retain fallback factors that are still stronger than SMS where possible, update help-desk identity-proofing so callers cannot trigger weak OTP resets casually, and track reduction in MFA-fatigue and vishing incidents.