Canada's latest phishing warning is a wake-up call for authentication

The latest warning from Canada's Cyber Centre is a reminder that even the strongest authentication strategy can have a very human entry point: a phone call.

On October 28, 2026, the Canadian Centre for Cyber Security issued an alert about an ongoing voice phishing campaign targeting Canadian organizations, particularly in the financial and legal sectors.

Attackers are impersonating internal IT support, creating urgency around MFA enrollment and password changes, and directing employees to convincing fraudulent sign-in pages.

Using adversary-in-the-middle (AiTM) techniques, attackers can relay credentials and MFA responses in real time to hijack authenticated sessions. From there, they can register unauthorized MFA methods, maintain access, and potentially exfiltrate sensitive data.

It's a reminder that attackers don't always need to break authentication. Sometimes, they just need to convince someone to help them get through it.

Authentication needs to protect the entire account lifecycle

Organizations have invested heavily in securing digital logins, but account takeover doesn't always begin or end at sign-in. Password resets, account recovery, MFA enrollment, and sensitive account changes can all create opportunities for attackers to gain or maintain access.

The Canadian Cyber Centre recommends deploying phishing-resistant MFA, including FIDO2 security keys and passkeys, while strengthening verification for account recovery, MFA resets, and new device enrollment.

This is where a layered approach to authentication matters.

FIDO2 passkeys use public-key cryptography and origin-bound authentication, protecting against credential phishing and real-time MFA relay attacks. Combined with risk-based authentication, organizations can evaluate contextual signals such as device, location, and suspicious behavior to trigger stronger verification when risk increases.

With adaptive MFA, that additional verification can be applied at critical moments, not just login. Whether someone is registering a new device, recovering an account, or changing authentication methods, the level of assurance should reflect the risk of the action.

Phishing-resistant authentication shouldn't be a feature of the login screen. It should be part of how organizations establish trust throughout the account lifecycle.

Extend that protection to one of the most vulnerable channels: the help desk and contact centres

But there's another part of the authentication journey that deserves attention.

The very channel attackers are exploiting in this campaign: the phone.

When someone contacts an IT help desk or call centre requesting an account recovery, password reset, or MFA change, identity verification can still depend on security questions, personal information, or an agent's judgment.

A convincing voice, familiar phone number, or knowledge of internal processes shouldn't be enough to authorize a sensitive account change.

With Authsignal Call Connect, organizations can extend strong identity verification into these interactions, integrating with existing ServiceNow, Salesforce Service Cloud, and Amazon Connect workflows.

Instead of relying on knowledge-based questions, agents can initiate a verification request and have the user authenticate on their own device using a FIDO2 passkey, push authentication, or biometrics. The agent receives the verification result within their existing workflow, without requiring users to share passwords or read out authentication codes.

Organizations can also apply consistent authentication policies across web, mobile, and contact centre channels, requiring stronger verification for high-risk requests.

When FIDO2 passkeys are used, this brings phishing-resistant authentication into the help desk, helping organizations protect sensitive account changes and recovery requests with the same level of assurance as a digital login.

Account takeover prevention can't stop at login

The Canadian advisory highlights a wider challenge: account takeover isn't always the result of a stolen password. It can begin with a convincing phone call, escalate through session hijacking, and persist through unauthorized MFA enrollment.

Protecting against these attacks requires more than stronger sign-in controls. It means applying the right verification at every high-risk interaction, across digital and human-assisted channels.

At Authsignal, we believe authentication should follow the user wherever trust needs to be established.

Because the answer to increasingly sophisticated social engineering isn't simply asking employees and help desk agents to become better at spotting a convincing impersonator.

It's giving them a reliable way to verify identity, regardless of how convincing the story sounds.

Explore Authsignal's approach to account takeover prevention | Discover Call Connect