The Trust Test

Emily worked on the helpdesk for a large insurance company. She had only been in the role for six months, but she was good at her job and always wanted to be helpful.

On a quiet Thursday afternoon, she received a call from someone claiming to be David, the company’s IT manager. She had spoken to David before, so she recognised the voice immediately.

“Hi Emily,” he said. “Sorry to bother you. We’re investigating a potential security incident and I need your help urgently.”

Emily sat up in her chair. “Of course. What do you need?”

David explained that several employee accounts had been targeted by hackers and that the IT team needed to verify user access before they could lock the accounts down. Everything he said sounded professional, and he even knew the names of Emily’s colleagues and the systems the company used.

A few moments later, Emily received a Microsoft authentication request on her phone.

“Can you approve that for me?” David asked. “It’s just to confirm your account is secure.”

Without thinking twice, she pressed Approve.

“Perfect,” he replied. “Thanks for your help.”

The call ended.

Emily thought nothing more of it until the following morning, when she arrived at work to find the office in chaos. Multiple employee accounts had been compromised, suspicious emails had been sent to customers, and confidential documents had been accessed overnight.

During the investigation, security staff traced the breach back to Emily’s account.

At first she couldn’t understand how it had happened. She hadn’t clicked any strange links, downloaded any files, or shared her password with anyone.

Then she remembered the phone call. When the security team listened to a recording of the conversation, they made a shocking discovery. The caller wasn’t David.

It was a cybercriminal who had used artificial intelligence to clone David’s voice using recordings from company presentations posted online. By sounding familiar and creating a sense of urgency, he had convinced Emily to approve the login request himself.

The attacker had never hacked a computer. He had simply persuaded someone to let him in.

Emily felt terrible, but the security manager reminded her that the attack had been designed to exploit trust, not technology.

“Don’t blame yourself,” he said. “The scam worked because it sounded real.”

Since that day, every employee received additional security training. Staff learned to verify unusual requests, even when they appeared to come from someone they knew.

Emily never forgot the lesson.

Months later, she received another urgent call from someone claiming to be from IT. This time, before doing anything, she hung up and called the real IT team directly.

The caller was a scammer.

They never got in.

Cybercriminals don’t always break into systems. Sometimes they simply convince someone to open the door for them. Always verify unexpected requests, even when they appear to come from a trusted colleague.