Is This Call from IT About a Passkey or MFA Update Real?
Updated: 18 hours ago
Your personal phone buzzes. "Hi, this is IT. We're rolling out passkeys today and your account will be locked in the next ten minutes unless you update it. I'm texting you the link now."
Pause right there. Treat that call as fake until you verify it yourself. Microsoft has described active campaigns that use exactly this story to take over Microsoft 365 accounts.
24uNet provides cybersecurity-first managed IT from Denver, Colorado, and College Station, Texas. Here's how to tell a real IT request from a fake one, what the attack looks like next, and the steps to take before you click anything.
THE SHORT VERSION
Treat it as fake until you verify. Attackers impersonate IT help desks and push urgent passkey, MFA, or SSO "updates" to steal Microsoft 365 sessions — often through phishing links or device-code approvals. Hang up, contact IT only on a number you already trust, and never enter a code or approve a prompt you didn't start yourself.
What these calls and texts look like
In September 2026, Microsoft's security researchers described cloud intrusions that begin with "identity-focused social engineering." The pattern they describe:
A call or message to your personal phone from someone claiming to be your company's IT help desk.
Urgency. A passkey, MFA or single sign-on (SSO) setting "must be updated immediately to avoid disruption."
A link, often by text message, to a site that closely resembles Microsoft's sign-in page.
Sometimes a message from a coworker. In a smaller number of cases, Microsoft says attackers used an already compromised account to send the same passkey-themed request through Microsoft Teams, so it came from a name you trust.
Microsoft is blunt about the motive: despite the passkey theme, "passkey enrollment is often not the actor's true objective." The passkey story is a pretext.
The story is the passkey. The goal is your session.
What happens if someone falls for it
Here's the chain Microsoft describes, in plain English:
You sign in through the attacker's path. Either a look-alike page that passes your sign-in to Microsoft and keeps a copy of your session, or a code you type into Microsoft's real page that approves the attacker's sign-in.
The attacker adds their own MFA method. Microsoft reports attackers "enrolled an MFA method under their control," such as a new phone number or authenticator app, so they can pass future MFA prompts without you.
They map your company and go after mail and files. Microsoft saw heavy activity across email, SharePoint and OneDrive, consistent with collecting data.
Everything looks normal to your settings. The sign-in was real and MFA was satisfied. What catches it is someone watching what the account does next, which is how ITDR catches Microsoft 365 account takeover.
One more detail from Microsoft stands out: investigators often rely on the employee's memory of a phone call or text as the earliest evidence of how the compromise began. That's why reporting the call matters, even if you hung up.
How this connects to device-code and AiTM phishing
The fake help-desk call is the lure. What happens after the lure is usually one of two techniques. In adversary-in-the-middle (AiTM) phishing, a fake page sits between you and Microsoft and captures your session after you pass MFA. In device-code phishing, you type a code into Microsoft's real page and unknowingly approve the attacker's sign-in. Both get past standard MFA without guessing anything. We explain each one, plus MFA fatigue attacks, in why MFA isn't enough.
How to verify the call (do this every time)
Give every person at your firm these five steps:
Hang up or ignore the text. Don't stay on the line with the caller while you "check."
Contact IT only through a channel you already know. Use the number in your company directory, your ticket portal, or a saved contact you've used before. For 24uNet clients: Denver (303) 468-5515 or College Station (979) 256-5100, or your normal ticket path. Never a number the caller gives you.
Ask yourself: did I request a passkey or MFA change today? Real IT almost never needs you to click a link from a cold call.
Never enter a code, approve an MFA prompt, or add a new sign-in method because an unexpected caller told you to.
Report the attempt to IT or security so others can be warned. If you already clicked or approved something, say so right away.
Real passkey enrollment happens when you start it yourself in your account security settings, or during a rollout your company announced ahead of time. It doesn't happen because a stranger called your cell. Passkeys are a strong protection when you set them up on purpose.
If you already clicked, approved a prompt, or gave a code
Don't wait and don't be embarrassed. These attacks are built to fool careful people.
Tell IT or security immediately, including what you clicked, typed or approved, and roughly when.
Expect your IT team to reset your password and revoke your sessions, so the stolen session stops working.
Expect them to remove any sign-in methods you don't recognize, such as a phone number or authenticator app the attacker added.
Expect a check of your mailbox for new inbox rules or forwarding, and a review of recent sign-ins and file access.
Microsoft's guide to responding to a compromised email account walks through the admin side. For catching this kind of takeover in the first place, see identity threat detection.
What firms should put in place (settings + people)
Microsoft's own recommendations for this campaign line up with a short list you can hand your IT provider:
Phishing-resistant MFA, such as passkeys or security keys, for admins and finance staff first, then everyone.
Tight controls on who can register new sign-in methods, so an attacker can't quietly add their own.
Device code sign-in blocked except where there's a real business need (more on this in our device-code phishing explainer).
A staff rule and a verified channel for reporting unexpected IT calls, texts or sign-in requests.
After-sign-in monitoring that watches what accounts do once they're in, through identity threat detection (how it works).
A written baseline of identity controls, like the identity group in our Security Baseline.
Some firms engage us for specific services like these under a service authorization. Others put IT and security under one master service agreement from day one, which is our Cybersecurity Business Bundle.
Frequently asked questions
Is this call from IT about a passkey or MFA update real?
Usually no. Treat unexpected calls or texts about passkey, MFA, or SSO updates as fake until you verify through a number or channel you already trust.
Why do attackers pretend to be IT about passkeys?
Microsoft reports that passkey-themed lures create urgency while the real goal is often stealing a Microsoft 365 session through phishing or device-code approval — not helping you enroll a passkey.
What should I do if I get the call?
Hang up. Contact IT only on a known number. Do not click links from the message. Do not enter codes or approve prompts you did not start.
What if I already entered a code or approved MFA?
Tell IT or security immediately so they can reset credentials, revoke sessions, remove unfamiliar MFA methods, and check mail rules and file access.
Are passkeys unsafe?
No. Phishing-resistant passkeys are a strong control when you enroll them on purpose. The risk is following an unverified stranger's instructions to "update" them right now.
How is this different from device-code phishing?
Device-code phishing is one technical path after the lure. This post is about recognizing the fake help-desk story; our companion post explains device-code, AiTM, and MFA fatigue in depth.
How does 24uNet help after a suspicious sign-in?
We help firms harden identity settings and watch what accounts do after they sign in. Call Denver (303) 468-5515 or College Station (979) 256-5100, or start at /itdr and /secure-your-network.
Talk to a real person at 24uNet
Got a suspicious IT call, or want identity monitoring that watches after sign-in? We can review your Microsoft 365 sign-in settings, show you where an attacker could add their own MFA method, and help you set a simple verify-first rule your staff will actually follow. Read how ITDR works, or reach a real person at 24uNet below.
Prefer to talk? Call Denver (303) 468-5515 or College Station (979) 256-5100.
Related reading: Advanced AI-driven Cybersecurity Solutions for Professional Firms; Customized Protection with Tailored Security Solutions.
ABOUT THE AUTHOR
Dane Gray, CEH, CompTIA Security+ — Cofounder, 24uNet. Dane has 30+ years in IT and cybersecurity and is a Cyber AB Registered Practitioner. He leads independent security reviews and Microsoft 365 identity hardening for firms served from 24uNet's offices in Commerce City, CO 80022 and College Station, Texas. Connect with Dane on LinkedIn.
Last reviewed: October 7, 2026
Comments