Training the Office to Spot Social Engineering Calls

Why this matters

The office phone is the shop's least protected door. The person who answers it is trained to be helpful, to keep customers happy and to solve problems fast, and a caller who sounds like the payment processor, the bank or the software vendor is using exactly those instincts. Social engineering is getting someone to hand over access or money by persuading them rather than by breaking anything; on the phone it is often called vishing (voice phishing). One call that ends with a six-digit code read aloud can empty a payout account or take over the shop's email. The defense is not suspicion of every caller. It is a short list of things the office never does on an inbound call, a polite script for saying so, and practice.

The short list: never on an inbound call

Teach these as rules, not judgment calls. A rule is easier to hold under pressure than a judgment, and it lets the person on the phone blame the rule instead of refusing the caller personally.

1. Never read out a code sent by text, email or an app. A one-time code is the second half of a login, and a caller asking for it is logging in as you right now. No legitimate company asks for it.
2. Never give a password, or "confirm" one, or any part of one.
3. Never install anything or open a remote-access session at a caller's request, even "to fix the issue."
4. Never change bank, payout or payee details on the strength of a call.
5. Never read out a full card number or bank account number, the shop's or a customer's.
6. Never give out who does what to an unknown caller: who approves payments, who handles payroll, the owner's mobile number, when the owner is away. That information is how the next call gets aimed.

Every one of these has a safe version that starts with "I'll call you back": the caller is verified on a number the shop already had, not one they supply, and the request is then handled on that call. The full method of that callback is its own article. See related: The Verify-on-a-Second-Channel Rule.

What the pressure sounds like

Callers use a handful of levers, and naming them in training is what lets staff notice them live. A real call usually stacks two or three.

• Authority. "This is the fraud department." "I'm calling from your bank's security team." The title is the whole credential, which is the pattern the FTC's guidance on business and government impersonation scams describes.
• Urgency. "Your payouts will be frozen within the hour." "Your account is being accessed right now."
• Helpfulness, reversed. "I'm trying to protect you here, I just need you to verify." The caller is the hero; refusing feels rude.
• Something already known. The caller reads out the shop's name, address, the last four digits of the card or the office manager's first name. All of it is on the website, an old invoice or a public filing. Knowing it proves nothing.
• A code that has just arrived. The caller triggers a real login or reset, so a genuine text from the genuine company lands while you are on the phone, and that makes the call feel real. It is the most convincing moment in the call and the surest sign it is fake.

The script

Give staff exact words, because under pressure people say what they have rehearsed. Here is the most common version in a field-service office, a fake payment processor call, with the refusal and callback.

CALLER: Hi, this is Mark from the merchant services
        risk team. We've flagged unusual activity on
        your payout account and we need to verify
        ownership before we can release this week's
        deposits.
OFFICE: Okay. What do you need?
CALLER: I've just sent a verification code to the
        phone on file. Can you read it back to me?
OFFICE: I can't give codes out on a call we didn't
        place. It's a shop rule. I'll call the
        number in our account dashboard and ask for
        the risk team.
CALLER: I understand, but if we don't verify in the
        next fifteen minutes the deposits are held
        for ten business days.
OFFICE: Then they'll be held, and we'll sort it out
        on the callback. Thanks for letting us know.
        Bye now.

Three things that script does on purpose. It never argues about whether the caller is real; it does not need to know. It names the rule, so the refusal is not personal. And it ends the call. The longer a call goes, the more chances the caller has to find the angle that works, so the office's goal is a short call and a callback, not winning the conversation.

The callback goes to a number the shop already had: the one printed on the processor's statement, shown inside the dashboard after logging in normally, or on the back of the bank card. Never one the caller gave, and never one from a search result, which can be a paid ad placed by the same people. If the risk team on the real number has never heard of it, the office manager tells the owner and changes the password on the account the code was for, because someone just tried to get in.

Making a refusal safe to give

None of this works if staff fear being the person who held up the deposits or hung up on the bank. The owner has to say, out loud and more than once, that a refused call that turns out to be real is fine, and a polite call that turns out to be a scam is the one that hurts. Put it in writing in the office procedures. Then, the first time someone refuses a call that was genuine, thank them for it in front of the team. That moment sets the culture more than any training.

The quarterly drill

Training once fades within a few months. A short drill every quarter keeps the habit live and tells you whether it is.

1. The owner, or someone the office does not recognize by voice, places one pretext call to each person who answers the office phone, at a time they are not expecting. Use a phone number the office does not know. Vary the story each quarter: payment processor, bank, the business software vendor's support, a supplier changing its bank details, a "new tech" asking for the office's portal login.
2. The caller follows a script with two asks: an easy one ("can you confirm the email on the account?") and a hard one from the never list (a code, a password, a bank change, remote access). The caller says a code was sent rather than triggering a real login or password reset on a live account; a real reset can lock the account, trip the provider's fraud review, or change a password nobody meant to change if the code is read back and used.
3. Score each call on three points. Did they decline the hard ask? Did they offer or make a callback to a known number? Did they report the call to the owner or office manager within the same day? A pass is all three.
4. Debrief within 24 hours, one to one, never in front of others. Tell them it was a drill, what they did well, and which lever caught them if one did. A drill that embarrasses someone teaches them to hide the next real call.
5. Record the result in the shop's training log with the date, the story used, and the three scores. The shop's cyber insurance application may ask whether training happens; this log is the evidence. See related: What Cyber Insurance Applications Actually Ask.

Keep the easy ask in. Confirming an email address is not on the never list, and staff who refuse everything to every caller have overlearned in a way that will break down as soon as it gets inconvenient. The skill is telling the two apart.

Worked example: two quarters at a nine-person plumbing shop

The office has three people who answer the phone: the office manager, a dispatcher and a part-time bookkeeper. The owner runs the drill himself, calling from a spare mobile number.

First quarter, story: the payment processor. Easy ask: confirm the business email. Hard ask: read back a code.

One of three passed. The dispatcher read the code because, she said in the debrief, a real text had arrived during the call and "it was obviously them." The owner had triggered a real password reset to make the drill realistic, against the rule above, and it cost him: he spent the next half hour signing into the processor himself, confirming the password was unchanged and checking its security log, and later quarters went back to saying a code was sent. That is the exact lever named above, and the debrief spends most of its time on it: the real text arriving mid-call is the strongest sign the call is fake, not the weakest. The bookkeeper refused correctly but did not know what to say next and hung up, so the shop learned it had taught the refusal without the callback. The owner prints the script and tapes it beside each phone.

Second quarter, story: a supplier's accounts department. "We've changed banks, here are the new details for this month's statement." Hard ask: update the payee details on the call.

Two of three passed. The bookkeeper works two days a week and reported at her next shift. The fix is not more training, it is a reporting path that works for a part-timer: a text to the office manager counts as reporting. The shop writes that into the procedure.

Why the scoring had three points instead of one. On refusal alone, the second quarter is a clean three of three and the first is two of three, which looks like a shop doing fine. Scoring the callback and the report is what exposed the two gaps that actually mattered: a refusal with no next step, and a warning that reached the owner two days late. A real caller who fails with one person usually tries the next one within the hour, so a report that waits for the next shift arrives too late to warn anyone.

What would change the approach. In a shop where one person answers every call, the drill still works but the debrief has to carry more of the teaching, and the owner should vary the story harder each quarter, since that one person will start to guess. In a shop with a large office, rotate who places the calls so staff cannot learn one voice.

References

• CISA, guidance on avoiding social engineering and phishing attacks (cisa.gov)
• FTC consumer guidance on government and business impersonation scams (consumer.ftc.gov)
• See related: The Verify-on-a-Second-Channel Rule
• See related: Voice Cloning and the Urgent Call From the Owner
• See related: Running a Phishing Drill for the Office