Cybersecurity Awareness Month Says Verify the Caller. At the Help Desk, That's Harder.

Every October, security teams borrow Cybersecurity Awareness Month material for their own training: a phishing reminder, a push on passwords and multi-factor authentication. This year CISA’s materials also cover the phone. They tell employees to be suspicious of an unexpected call and to verify it through a number they already have. That is sound advice. At a help desk it turns into a callback, and CISA’s own advisory on Scattered Spider describes attackers who take control of an employee’s phone number.

What is Cybersecurity Awareness Month, and who runs it in 2026?

Cybersecurity Awareness Month is a security-behavior campaign that runs every October. The National Cybersecurity Alliance, which calls it “a global initiative,” describes the campaign’s origin: “Launched in 2004, the National Cybersecurity Alliance and Cybersecurity and Infrastructure Security Agency (CISA) lead the campaign every October” (National Cybersecurity Alliance, 2026). CISA’s toolkit page calls the agency “the federal lead for the campaign” (CISA, 2026).

This year the two organizations are each promoting the campaign under a different theme. CISA’s 2026 theme is “Securing the Next 250,” which the agency says “recognizes the nation’s 250th anniversary and focuses on building a secure digital future for America’s next era” (CISA, 2026). The National Cybersecurity Alliance’s 2026 theme is “Don’t Make It Easy for Them” (National Cybersecurity Alliance, 2026).

What CISA’s 2026 materials say about phone calls

CISA’s page lists the actions it wants organizations to take this October: teach employees to avoid phishing scams, require strong passwords, require multi-factor authentication, update business software, use logging, back up data, encrypt data, share cyber incident information with CISA, migrate to the .gov domain, have an incident response plan and use it, and be prepared for system disruptions (CISA, 2026). The National Cybersecurity Alliance’s list is shorter and aimed at individuals: use a strong password and a password manager, turn on multi-factor authentication, recognize and report scams, and update your software (National Cybersecurity Alliance, 2026).

The phone appears in CISA’s supporting material. Its poster for the phishing item reads: “Keep an eye out for phishing and other scam attempts in your emails, texts, direct messages or phone calls. Always verify the sender before clicking links or downloading attachments” (CISA, Cybersecurity Awareness Month poster, 2026). Its presentation deck adds that “Legitimate organizations don’t ask for personal information through email or an unexpected call,” and tells people to “Verify that the communication is real and contact the sender directly through known phone numbers or emails” (CISA, Cybersecurity Awareness Month deck, 2026). CISA’s fact sheet for businesses gives staff the same rule: when a message feels off, use “a known contact method you already have” instead of the number or link the message came with (CISA, Four Cybersecurity Essentials for Businesses, 2025).

The principle is the right one: check a claim through a channel you already trust. None of these materials mentions a help desk, but the principle applies there as well.

At the help desk, verifying through a known number means a callback

A help desk agent taking a call from someone who says they’re a locked-out employee is in the position CISA describes: an unexpected call, a claimed identity, and a request. Following CISA’s advice means hanging up and calling the employee back on the number the company has on file.

That is one of the two directions CISA’s advisory on Scattered Spider documents. In its July 2025 update, the advisory describes actors who “Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control” (CISA Advisory AA23-320A). In the other direction, actors “Posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees,” which is closer to the call CISA’s campaign advice is written for.

Separately, two 2023 incidents show what social engineering aimed at IT support can cost. MGM Resorts reported roughly $100 million in impact on its third-quarter 2023 results (MGM Resorts, Form 8-K, October 2023). Its own chief executive later called the company’s tech call center “the layer that got engineered” (Las Vegas Review-Journal, October 2023), and said the attack was “partially socially engineered.” Caesars Entertainment’s own Form 8-K describes “a social engineering attack on an outsourced IT support vendor” (Caesars Entertainment, Form 8-K, September 2023); Caesars reportedly paid about $15 million (The Wall Street Journal, September 2023).

The pattern hasn’t gone away. Mandiant found voice phishing — phone-based social engineering — was the initial infection vector in 11% of intrusions in 2025, second only to exploits (Mandiant, M-Trends 2026).

Why a callback can reach the attacker

A callback proves that someone can answer the number on file. That is a weaker thing than proving who they are. The same CISA advisory describes Scattered Spider actors who “Convinced cellular carriers to transfer control of a targeted user’s phone number to a SIM card in their possession, gaining control over the phone and access to MFA prompts” (CISA Advisory AA23-320A). Once the number has moved, the help desk’s callback rings on the attacker’s phone.

The voice that answers can be convincing, too. McAfee researchers produced a clone with an 85% voice match from three seconds of audio in one test (McAfee Labs, 2023). Across the 1.2 billion calls Pindrop analyzed in 2024, deepfake fraud attempts rose by more than 1,300%, from about one a month to seven a day (Pindrop, Voice Intelligence & Security Report, 2025). Two earlier Trusona posts go further into why an agent can’t settle this by ear: Your Help Desk Agent Can’t Tell It’s Not You Anymore and AI Driven Social Engineering: The New Frontier in 2026.

Check something the attacker can’t move

CISA’s principle still holds at the help desk: verify the claim against something the attacker doesn’t control. Once a carrier has moved the number, the number on file fails that test. A government-issued ID is recorded with the authority that issued it, and moving a phone number doesn’t change that record.

ATO Protect for IT Help Desk is built on that check. The agent sends a secure link to the number on file, and the caller scans a government-issued ID in their mobile browser, which is checked against the authority that issued it — in the US, the state DMV over the AAMVA network — in real time. A moved number can put that link in an attacker’s hands, but whoever opens it still has to present an ID that checks out with the issuer. It works on a caller’s first interaction, with no prior enrollment required, so a day-one hire gets the same check as a ten-year employee. Mobile network operators can also flag when the caller’s number recently moved to a new SIM, which is the move the advisory describes. Man-in-the-middle detection is patented (US Pat. 10,601,859). It runs no selfie or liveness check, because generative AI can now defeat those methods. All user PII from the verification session is deleted, and verification reaches NIST IAL2, on SOC 2 infrastructure.

A one-question checklist for October

Awareness Month gives every security team a reason to review what its people are taught, and the help desk’s own procedure belongs in that review. Ask one question of it: when someone calls saying they’ve lost access, what confirms who they are? If the answer is a callback to the number on file, ask what happens when that number has already moved.

Frequently asked questions

What is Cybersecurity Awareness Month, and who runs it in 2026? It’s an annual security-behavior campaign held every October, which the National Cybersecurity Alliance calls “a global initiative.” The Alliance says the campaign launched in 2004 and that it and CISA lead it every October. CISA’s own 2026 materials describe the agency as “the federal lead for the campaign.”

What are the 2026 themes for CISA and the National Cybersecurity Alliance? The two organizations are running different named themes this year. CISA’s is “Securing the Next 250,” tied to the nation’s 250th anniversary and framed around critical-infrastructure resilience. The National Cybersecurity Alliance’s is “Don’t Make It Easy for Them,” framed around everyday habits: strong passwords, multi-factor authentication, recognizing and reporting scams, and updating software.

Does Cybersecurity Awareness Month cover phone scams? CISA’s materials do. Its 2026 poster tells employees to watch for scams in “emails, texts, direct messages or phone calls,” and its 2026 deck says to “contact the sender directly through known phone numbers or emails.” CISA’s 2026 campaign pages and files, and its fact sheets for businesses and for state and local governments, do not mention a help desk (checked September 2026).

Is a callback enough to verify a help desk caller? A callback confirms that someone can answer the number on file. CISA’s advisory on Scattered Spider describes actors who convinced cellular carriers to move a targeted user’s phone number to a SIM card they held (CISA Advisory AA23-320A). A callback to that number would then reach the attacker.

How can a help desk verify a caller without trusting the callback? ATO Protect for IT Help Desk sends a secure link to the number on file, and the caller scans a government-issued ID that is checked against the authority that issued it. A moved number can still receive the link, but whoever opens it has to present an ID that checks out with the issuer, and ATO Protect can flag a number that recently moved to a new SIM. It works on a first-time caller with no prior enrollment, and it runs no selfie or liveness check.

CISA’s advice to verify through a known number is right for the person who gets an unexpected call. At the help desk, the known number is something an attacker can move.