The summary.
WHERE ATTACKS ACTUALLY SUCCEED
A person doing something reasonable-seeming. Not technical defeat of your controls.
WHAT NO LONGER WORKS AS A TEST
Spelling and grammar. You cannot judge authenticity from the message itself.
WHAT DOES WORK
Verification through a separate channel, on a number you already held. Never the number in the message.
THE ONE HABIT THAT DEFEATS MOST ATTACKS
Never use links in messages about accounts. Go to the site the way you normally do.
THE ABSOLUTE RULE
Never give a verification code to anyone, however they identify themselves.
A code is for you alone. Anyone asking for it is taking your account.
ON INBOUND CALLS
End the call and ring back on a number you already had.
Never grant remote access to a device to a caller.
URGENCY IS THE TACTIC
The more urgent a request, the more verification it warrants.
WHAT TO TELL YOUR TEAM, REPEATEDLY
That they may verify a request appearing to come from you, and will never be criticised for it.
And that reporting a mistake immediately is always the right action, with no blame attached.
