The support call, the invoice zip and the instruction to stay quiet
At a 25-person accountancy firm the receptionist takes a call from a man claiming to be from Microsoft Support. He says the file server is sending virus alerts and asks her to install a remote-access tool so he can clean it. She is put on hold and comes to find you. Meanwhile the shared accounts inbox has an email that appears to come from a regular supplier, but the sender address reads [email protected]. It carries a password-protected invoice.zip and says open before 5 pm. The office Wi-Fi password is identical for all staff and is written on a card taped inside the reception drawer. When told, the office manager says: just bin the email, don't log a ticket, I don't want auditors asking questions.
1. Set out your actions for the next 30 minutes, in priority order, covering both the phone call and the email, and say why each step comes where it does.
Read the worked answer
Contain first, then verify, then report.
- Tell the receptionist to end the call and install nothing. If a remote tool was already started, disconnect the machine from the network by unplugging the cable or disabling Wi-Fi, and leave it powered on so evidence survives. Containment precedes everything else because a remote session gives an attacker a live foothold.
- Verify through an independent channel: ring IT on the internal extension or a number from the firm's own records, never a number the caller supplies. Microsoft does not cold-call about virus alerts, and no legitimate support needs an unsolicited remote tool.
- Do not open the attachment and do not reply. Capture the full email headers, sender domain and the message, then report to IT so the sender and domain are blocked and other staff are warned.
- Note why the zip is suspicious: a lookalike domain (supp1ier), urgency with a 5 pm deadline, and a password-protected archive, which is a standard way to slip past mail scanning because the contents cannot be inspected.
- Ask whether anyone opened it; if so, isolate that machine and reset credentials.
- Log the incident with times and the people involved, then notify the manager in writing.
2. The manager instructs you to delete the email and not log the incident. How should you respond, and what do you actually do?
Read the worked answer
Do not simply comply. Deleting the message destroys the evidence needed to block a sender who may be targeting other staff, and failing to log an incident is inconsistent with the firm's duty of care over client data and with the record-keeping expectations of its professional body and data protection obligations.
Respond factually rather than confrontationally, in writing: summarise what arrived, what was done, and what is being asked of you, and state the specific risk, which is that a suppressed incident is far more damaging than an audit question. Point out that auditors usually ask whether incidents are logged and lessons applied, not whether any occurred; a documented, well-handled near-miss reads as good governance.
Then escalate along the documented route: the data protection lead or IT manager, and if the firm has one, the compliance partner. Keep the tone professional and avoid attributing motive. If the instruction is repeated, follow the escalation chain rather than deleting records, and note that whistleblowing protections may apply where client data is at risk.
Separately, thank the receptionist publicly for reporting. Punishing or ignoring reporters is how an organisation loses its early-warning system.
3. Propose two changes, one to the Wi-Fi setup and one to email handling, and explain how you would roll each out without stopping the firm's work.
Read the worked answer
Wi-Fi. Remove the single shared key. Either move staff to individual logins with WPA2 or WPA3-Enterprise, or at minimum keep a separate guest network that reaches only the internet, so a leaked password never exposes file shares. The card in the reception drawer is also a physical security problem: visitors and cleaners can read it, and it never expires when a leaver departs. Rollout: announce a week ahead, switch the network during a quiet window such as Friday after 5 pm, pre-configure managed laptops, and keep the guest network up so nothing is offline.
Email. Enable multi-factor authentication on every mailbox, add filtering that quarantines password-protected archives and newly registered or lookalike domains, and give staff a one-click report-phish button. Rollout: start with reception and accounts, who receive the most external mail; issue a password manager so nobody is locked out; run a harmless simulated phish to measure the reporting rate rather than to shame individuals.
Measure both changes: time from receipt to report, click rate, and the number of quarantined messages. Review after one month and adjust rather than assuming compliance.