A staff member suddenly started receiving thousands of unexpected emails.
Password resets. Newsletter confirmations. Account signups. Random messages from services they had never used.
At first, it looked like a spam problem. But it was really a setup.
The attacker was flooding the inbox on purpose. The goal was to create confusion, stress, and urgency. If important messages were buried and the mailbox started acting strangely, the next step would feel believable.
The caller claimed to be from IT. They used a confident voice and acted like they already knew what was happening.
That is the moment the attack changed — from email bombing to helpdesk impersonation.
The staff member did exactly the right thing.
They did not argue. They did not follow instructions. They did not install anything. They did not give remote access.
They hung up and contacted the real IT support team through the normal, trusted channel.
Because they paused and verified, the incident stayed contained. The real IT team investigated the flood of email, put temporary protections in place, checked for signs of compromise, cleaned up the immediate mess, and helped restore the mailbox to normal use.
The important part: because the user hung up first, IT was cleaning up an attack attempt — not recovering from a breach.
If the attacker had convinced them to continue, the caller likely would have tried to:
The email flood was the distraction.
The phone call was the real trap.
If someone unexpectedly contacts you claiming to be IT and asks for remote access, stop. Hang up. Then contact IT using the normal support number, ticket system, or trusted internal channel. A real IT team will not be offended when you verify — we want you to verify.
If you receive a suspicious IT support call: