Question

A help desk technician receives a phone call from someone claiming to be the new regional IT director. The caller uses technical jargon, sounds authoritative, and urgently demands the technician reset the CFO's password and read the temporary password back over the phone so the 'director' can log in before an executive meeting. The caller pressures the technician not to bother the CFO because 'there's no time.' Which action best mitigates this social-engineering attempt?

Accepted Answer

Follow the established identity-verification procedure and call back through a known internal directory number before taking any action

Answer

Reset the password as requested, since the caller demonstrated detailed knowledge of internal systems and titles

Answer

Reset the password but email the temporary password to the director instead of reading it aloud

Answer

Ask the caller for the CFO's employee ID number and proceed if they can provide it