Most people are trained to distrust strangers asking for passwords.
They are less likely to distrust someone claiming to be IT support.
Microsoft documented 2026 attacks in which threat actors impersonated support personnel and used authentication-related stories to persuade victims to take action.
The defence is procedural.
A legitimate support process should give employees a safe way to verify who they are dealing with.
Do not allow an unexpected caller to dictate security steps simply because they know your name, employer or department.
Use the organisation's official helpdesk channel and initiate the conversation yourself when possible.
The person who sounds helpful can still be the attacker.