Free business safety checklist
Before trusting a support call
Hang up. Check independently. Then decide.
For staff receiving unexpected IT support calls, remote-access requests or alarming popups.
Download the A4 PDF1 page · A4 portrait · PDF · 230 KB · No signup required
Five checks to use at work
- Treat the call as unverifiedKnowing your name or workplace does not establish that an unexpected caller is genuine.
- Call your usual IT teamCaller ID is not proof. Contact IT or the organisation using a number you already trust.
- Verify before granting accessDo not install software, share your screen or grant control until independently verified and approved.
- Keep secrets privateNever give passwords, banking codes or recovery codes. Do not approve unexpected MFA requests.
- Reject payment pressureDo not transfer money to “protect” it or call numbers displayed in suspicious popups.
Already allowed remote access?
- End the remote session and disconnect the internet. Contact IT using another device or phone.
- If you paid or exposed banking information, contact your bank immediately.
- With IT help, change exposed passwords from a trusted device.
Sources and further reading
Primary guidance checked in October 2026. Your organisation’s procedures and IT team should guide the response to a real incident.