In late September 2026, Astrana Health, a US healthcare company, told the Securities and Exchange Commission that attackers had impersonated its staff and spoofed the company’s own main phone number to talk employees into handing over access. The company says private and confidential information was taken, possibly including patient, employee and business records. The call looked like it came from inside the company because, on the caller ID, it did.

October is Cybersecurity Awareness Month, and this year’s CISA theme is “Securing the Next 250.” Most of the advice you will hear this month is about email. This guide is about the phone, because a phone call skips every filter you pay for.

Why phone attacks work on good employees.

A phishing email has to get past a filter and still look right when someone reads it slowly. A phone call reaches a helpful person directly, in real time, with pressure attached: a locked-out executive, an urgent payment, a “security problem” that has to be fixed now. Caller ID can be faked, and in July the FBI warned that a real call from someone you know and an AI-cloned voice “can sound nearly identical.” A familiar number and a familiar voice are no longer proof of anything.

The caller usually wants one of four things: a password or sign-in code read aloud, a reset of someone’s multi-factor sign-in, a remote access tool installed “so IT can take a look,” or a change to where money goes. Each one can be blocked with a habit, not a new product.

Five habits that stop a convincing caller.

Hang up and call back

When a call asks for access, codes or money, end it politely and call back on a number from your own directory or the vendor’s contract, never one the caller gives you. A real colleague will not mind. An attacker cannot answer a number they do not control.

Give the help desk a script

Password resets, multi-factor resets and new phone enrollments should never happen on the strength of an inbound call alone. Confirm the person with a call back to the number on file and, for administrator accounts, a second approval from their manager.

Allow one remote support tool

Pick a single approved remote access tool, installed and managed by IT, and block the rest. Staff should know that nobody legitimate will ask them to download a different one during a call. Restricting remote access tools was part of Astrana’s own response.

Make sign-ins hard to hand over

Move important accounts to phishing-resistant sign-ins such as passkeys or security keys, which give a caller no code to ask for. Turn on alerts when a new sign-in device is added to an account, especially an administrator’s.

Reward the pause

The employee who stops and verifies is doing the job right, even when the call turns out to be real and the delay annoyed someone senior. Say so in front of the team, and give people one simple way to report a strange call within minutes.

What good looks like

A verification rule everyone can repeat.

The test is simple. Ask any employee what they do when a caller asks for a code, a reset or a payment change. If every answer is the same, the control is working. If it depends on who picks up the phone, it is not.

Known numbers only

Call backs use a directory or contract number. A number given during the call is never used.

Two people for money and access

New bank details, large payments and administrator resets need a second person to approve.

One remote tool

Only the approved remote support tool can run. Anything else is blocked or raises an alert.

A record of every reset

The help desk notes who asked, how the person was confirmed and who approved it.

This month’s checklist

Start with CISA’s four basics, then add the phone.

For Cybersecurity Awareness Month, CISA asks every organization to teach employees to avoid phishing, require strong passwords, require multi-factor authentication and keep software updated. Those four still stop most everyday attacks. Add one more for October: run a five-minute practice call with your front desk and finance team, and see what they do.

Ask your IT provider

Questions that reveal the real condition.

How does your help desk confirm who is calling before resetting a password or multi-factor sign-in?
Which remote access tools could run on our computers today, and which are blocked?
Would we be alerted if a new sign-in device was added to an administrator account?
How quickly can you lock an account after an employee reports a suspicious call?
When did our team last practice a call back?

The practical takeawayA caller ID and a familiar voice are not proof of identity. A call back to a number you already trust is.

Sources