Fake IT Help Desk Attacks: How to Protect a Small Team With No IT Department

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

Here is a scam that works best on businesses that do not have an IT department. An employee's inbox suddenly fills with hundreds of newsletter sign-ups. A few minutes later, a message pops up in Microsoft Teams from "IT Service Desk (Matthew)," offering to fix the problem. Matthew asks for a quick call, then for a six-digit code so he can "take a look." Fifteen minutes later, the attacker is running code on that computer.

This is not a rare case. Arctic Wolf has analyzed more than 400 incidents in which attackers used Teams external chat to pose as IT support, and it says that once a victim engages, attackers reached payload execution in under 15 minutes in the cases customers reported. In a separate report covering the third quarter of 2026, Cisco Talos found that fake help desk callers needed little more than employee names and email addresses to talk people into opening remote access sessions. In one case, that access ended in ransomware.

If your "IT department" is you or an outside provider you call twice a year, this guide is for you.

Why Small Teams Are an Easy Target

In a large company, employees know who IT is, and there is usually a known help desk number and a security team watching. In a five- or fifteen-person business, none of that exists, so an unfamiliar "IT person" is not obviously out of place. Nobody knows what real IT support is supposed to look like, because there is not any.

Attackers do not seem to need to research you, either. Talos said it found no clear evidence of deep company- or victim-specific profiling beyond basic identity and contact information, and that the people contacted varied within the same organization. In other words, they are looking for any one person who will say yes. A small team gives them fewer people to try, but also fewer safeguards behind each one.

How the Scam Works, Step by Step

1. The inbox flood

The attack often starts with what researchers call email bombing: hundreds of subscription confirmations and newsletters arriving within minutes. It looks like a technical problem and makes the employee want help fast.

2. The "IT support" message

Microsoft Teams allows people in other organizations to message your staff by default. Attackers set up their own Microsoft 365 accounts with names built around words like support, helpdesk or admin. Arctic Wolf found that 30 to 40 percent of the cases it analyzed used default onmicrosoft.com domains, which can be created within minutes. Display names are designed to look internal, such as "IT Support (Internal)" or "IT Service Desk – Liam," even though Teams labels the sender as External.

3. The call and the code

The fake technician usually switches to a voice call and walks the employee through opening a remote access tool. Quick Assist is the most common choice because it is built into Windows and signed by Microsoft. The victim only has to read back a six-digit code. AnyDesk, ScreenConnect, TeamViewer and similar tools also appear.

4. The takeover

Once connected, the attacker installs a second remote access tool so they can keep their access even if the first session is closed, then moves on to stealing passwords, exploring the network and, in some cases, deploying ransomware. The same pattern shows up over the phone, too. Our article on vishing attacks targeting Microsoft 365 covers the voice-call version in more detail.

Five Defenses a Small Business Can Set Up This Week

1. Tell everyone what real IT support looks like

This is the most effective step, and it costs nothing. Send your team a short note that says who actually provides IT help, how they will contact you, and what they will never do. For example: "Our IT help comes from [name or provider]. They will never message you from an external Teams account, and they will never ask you to open Quick Assist or read out a code unless you called them first." Arctic Wolf's own advice is to tell staff which channels and named contacts real IT uses, and to treat unsolicited external "IT support" as suspicious, especially after a spam flood.

2. Make the External label mean something

Teams marks messages from other organizations as External, and shows an Accept or Block prompt the first time an outsider writes. Show your team what that looks like and make a simple rule: anyone claiming to be internal IT who shows up as External gets blocked and reported.

3. Limit who can message your team from outside

If you use Microsoft 365, the Teams admin center lets you change external access. Arctic Wolf recommends moving from allowing every outside organization to an allow-list of the partners you actually work with, blocking chats from unmanaged personal Teams accounts, and blocking trial-only accounts. If you have an outside IT provider, ask them to make this change, and make sure your real clients and vendors are on the list first.

4. Use a callback rule for any remote access request

Nobody gets remote control of a company computer because of an incoming message or call. If someone says they need access, the employee hangs up and calls a known number, such as your provider's number from their invoice, not one given in the chat. Talos also recommends phishing-resistant multi-factor authentication and checking identity at the help desk before anyone can add a new MFA method. See session hijacking and token theft for why stolen logins matter.

5. Know exactly who is on your team and what they use

Fake help desk scams work best when nobody keeps track of who is on the team, which devices they use and which tools are approved. Keep a simple list of everyone with company access and the devices they use. Remove remote access tools you do not use. When someone leaves, take their access back the same day. Our offboarding guide walks through what to remove.

Where CyberFence Teams Fits, and Where It Does Not

It is important to be straight about this. A fake help desk attack is a people problem first. If an employee reads a code out to a stranger, no VPN will stop that stranger from controlling the screen. The steps above, especially the note to staff and the callback rule, are what actually stop this scam.

What CyberFence Teams helps with is the rest of the basics that small businesses usually skip:

• Each person has their own account. You invite people from the web dashboard, they set up their account and install CyberFence on their supported devices. No shared logins, which makes it easier to see who is on the team.
• Setup and connection information in one place. The dashboard shows who has connected, who has never connected and whose invitation is still pending. Use it to guide follow-up, not as proof of continuous protection. See how to know if employees are using the VPN.
• Web Shield blocks known harmful sites. It uses lists of known bad sites, so it can stop some malicious pages and downloads, but it cannot block a site that is not on those lists yet.
• Breach Monitor on every seat. It checks each member's email address against known breaches. If an email appears in a breach, you can ask that person to change the password before an attacker uses it. It helps identify known exposure; it does not prevent a breach.
• Revoke access in one place. When someone leaves, you revoke their access from the dashboard and the seat can be reused.

CyberFence also encrypts each person's internet connection with AES-256-GCM, which matters on hotel, airport and coffee shop Wi-Fi. It does not manage your Microsoft 365 settings, replace multi-factor authentication or monitor what happens inside a remote access session.

A One-Page Checklist

1. Send your team a note naming your real IT contact and what real IT will never ask for.
2. Show everyone the External label and the Accept or Block prompt in Teams.
3. Ask your IT provider to review Teams external access and limit it to partners you trust.
4. Adopt a callback rule for every remote access request.
5. Turn on multi-factor authentication for email and key business tools.
6. Remove remote access tools you do not use.
7. Keep a current list of team members and devices, and take access back the day someone leaves.

For new hires, add this to your new-hire cybersecurity checklist, and put the callback rule into a simple remote work security policy so it is written down. If you want to know what all of this costs, see what it costs to protect a small team.

The Bottom Line

Fake IT help desk scams take advantage of something small businesses rarely have: a clear picture of what real IT support looks like. Write it down, share it, make the External label a red flag and require a callback before anyone hands over control of a computer. Then cover the basics, such as separate accounts, protected connections and access you can take back, so a single mistake does not turn into a bigger problem.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .