Fake IT Support Calls and Account Takeover Prevention
Recognize fake IT, vendor, and help-desk calls. Protect sign-in and MFA from caller pressure. Spot fake sign-in pages, malicious app permissions, and unsolicited remote-support requests — then report, even after you've already approved something.
What you'll learn
- Verify unexpected IT, vendor, and district support requests by contacting the approved help desk through a number you already have in your organization's directory — not one the caller provides.
- Protect sign-in and MFA under pressure: never share one-time codes, never approve unsolicited MFA prompts, and prefer passkeys or security keys to codes an attacker can request.
- Recognize fake sign-in pages pushed through caller-provided links or urgent 'verify your account' prompts, and sign in only through trusted bookmarks and approved applications.
- Spot malicious app-permission (OAuth consent) requests that would give an outside app access to records, mailbox, or cloud data, and route new apps and integrations for approval instead of granting consent on the spot.
- Refuse unsolicited remote-support software and refuse to paste commands at a caller or web page's request — follow the organization's documented support process instead.
- Report every incident immediately — even after sharing a code, approving a prompt, or installing something — and preserve the time, call details, and screen state without deleting evidence.
Requirements
- A workstation, laptop, tablet, or phone with a modern browser.
- Audio or captions enabled so you can follow the narrated video for each module.
- No prior cybersecurity knowledge required — this course is especially useful for help-desk staff, IT support, administrators, teachers, agency staff, and vendor personnel.
Course content
7 chapters · 6 lectures · 29m 30s total
Module 1 — Verify Support Requests
What a fake IT, vendor, or district help-desk call actually sounds like — and the one habit (independent callback) that collapses almost all of them. The two phrases that should always trigger verification.
1 item
Module 1 — Verify Support Requests
What a fake IT, vendor, or district help-desk call actually sounds like — and the one habit (independent callback) that collapses almost all of them. The two phrases that should always trigger verification.
-
Verify Support Requests Free preview5 minutes
Module 2 — Protect Sign-In and MFA
Why attackers call: they already have your password and need you to finish the sign-in for them. The rules for one-time codes, MFA pushes, and MFA fatigue — and why passkeys change the game.
1 item
Module 2 — Protect Sign-In and MFA
Why attackers call: they already have your password and need you to finish the sign-in for them. The rules for one-time codes, MFA pushes, and MFA fatigue — and why passkeys change the game.
-
Protect Sign-In and MFA5 minutes
Module 3 — Recognize Fake Sign-In Pages
The pixel-perfect fake sign-in pages that back up almost every fake-support call, and the simple habit — sign in only through your trusted bookmark or approved app — that defeats them.
1 item
Module 3 — Recognize Fake Sign-In Pages
The pixel-perfect fake sign-in pages that back up almost every fake-support call, and the simple habit — sign in only through your trusted bookmark or approved app — that defeats them.
-
Recognize Fake Sign-In Pages5 minutes
Module 4 — App Permission Traps
The newer attack that doesn't need your password at all — malicious OAuth consent prompts asking you to grant an outside app access to your mailbox, files, calendar, or records system. What a legitimate app approval looks like and when to route for review.
1 item
Module 4 — App Permission Traps
The newer attack that doesn't need your password at all — malicious OAuth consent prompts asking you to grant an outside app access to your mailbox, files, calendar, or records system. What a legitimate app approval looks like and when to route for review.
-
App Permission Traps5 minutes
Module 5 — Remote Support and Fake Fixes
The 'please install this remote-support tool so I can see your screen' call, and the 'please paste this command into PowerShell to fix the error' web page — two of the most common ways attackers walk right onto a workstation.
1 item
Module 5 — Remote Support and Fake Fixes
The 'please install this remote-support tool so I can see your screen' call, and the 'please paste this command into PowerShell to fix the error' web page — two of the most common ways attackers walk right onto a workstation.
-
Remote Support and Fake Fixes5 minutes
Module 6 — Report After Approval
The most important module in this course: what to do after you've already shared a code, approved a prompt, installed something, or pasted a command. Why speed matters, what to preserve, and who to call.
1 item
Module 6 — Report After Approval
The most important module in this course: what to do after you've already shared a code, approved a prompt, installed something, or pasted a command. Why speed matters, what to preserve, and who to call.
-
Report After Approval4 minutes 30 seconds
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
1 item
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
-
Final Assessment — Fake IT Support Calls and Account Takeover Prevention