Every fall we brief our client firms' staff before busy season. This year's briefing opened with two numbers from Microsoft's 2026 Digital Defense Report, and together they explain everything that follows. Password attacks fell 26 percent year over year. Multi-factor authentication and password managers, the unglamorous controls firms adopted over the last three years, are doing exactly what they were supposed to do. And 47 percent of observed break-ins now begin with a person being talked into clicking, pasting, or approving something.
Read those together and the picture is encouraging. Threat actors did not get through the technology, so they moved to the people. The remaining risk is a conversation, and conversations are something your team can learn to recognize. Below are the five asks we are seeing most, written the way we present them to staff: what it looks like, why it works, and the rule that ends it.
1. The web page that asks you to paste a command
A page copies the familiar "I am not a robot" checkbox, reports that verification failed, and asks you to press a few keys: the Windows key plus R, then Ctrl plus V, then Enter. Those three keystrokes open the Run box, paste a command the page quietly placed on your clipboard, and run it. The payload is usually remote-control software or a password stealer that also grabs live browser sessions.
It is everywhere because it does not travel by email. Microsoft counted 1.1 million devices hit between February and May, and four in five arrived from search results, ads, and compromised websites, so the spam filter never sees it. It also appears as fake "fix this error" pages and fake software installers.
The rule: no legitimate website ever needs you to open the Run box or a terminal and paste something. Close the tab and tell your technology team. If someone already pressed the keys, still tell them: endpoint controls usually catch the install, and a fast report turns cleanup into a non-event.
2. The call or chat from "IT"
Microsoft reports confirmed Teams voice-phishing volume up 502 percent year over year. The script is always the same: a confident person, a plausible problem (unusual sign-ins, a mailbox about to lock), and a clock. Then the ask: read me the code that just arrived on your phone, approve the prompt I am about to send, install this remote tool so I can fix it.
Teams labels external senders and unknown organizations. Those labels matter. But the rule that protects your firm does not depend on spotting them.
The rule: verification only runs one direction. Your technology provider verifies you before a reset or a change; nobody legitimate needs you to prove yourself to them with a code or an approval. No real support team, and not Microsoft, will ever ask for your MFA code, an approval, or your password, by phone, chat, or email. Hang up or close the chat, then call the support number you already have. A real technician is glad when you say you will call back.
3. The MFA push you did not ask for
A push notification you did not trigger is good news in disguise: your MFA just told you that someone has your password and is standing at the door. The failure mode is approving to make the buzzing stop, or approving because a "coworker" asked you to. One approval is all they need.
The rule: deny it, tell your technology team, keep working. A password reset and a review of the sign-in logs takes minutes, and you just caught an attack. Microsoft also saw fake sign-in pages that steal live sessions more than double in early 2026; app-based MFA blocks most of that, and passkeys close it fully, which is why we wrote a separate guide to the Microsoft 365 passkey rollout.
4. The busy-season lures: the new client, the cloned email, the bank change
The IRS and its Security Summit partners flagged this pattern in August (IR-2026-85): the "new client" who arrives with documents attached before you asked, plus clone phishing (a real past email re-sent with a swapped link) and whaling aimed at whoever handles payments. Five tells, in any mix:
- A sender address that almost matches a real company. One doubled letter in the domain is enough.
- A stranger with documents attached before you asked. A zip file of "last year's return and bank statements" from someone you have never spoken to.
- Urgency with a reason you cannot check. A lender deadline, by end of day today.
- A bank or payment detail slipped into an ordinary note. "Could you confirm the best account for your retainer? I want to be sure it has not changed."
- A link to a "portal" you did not set up.
Two notes for this season. Spelling and grammar are no longer tells; AI writes clean emails. And expect QR codes: Microsoft Threat Intelligence described a February campaign that mailed personalized fake W-2 documents with QR codes to roughly 29,000 people.
The rule: new prospects get a phone call to a number you look up yourself, and documents come in only through the firm's portal. Everything else gets reported as phishing.
5. AI, on both sides of the inbox
On the attacker's side, AI changed three things. The writing is clean: Push Security found signs of AI-written text in roughly nine of ten phishing kits it analyzed this year, and each message can name you, your firm, and a real client. Voices are clonable: a few seconds of audio from a voicemail or a webinar is enough to imitate a partner or a client asking to move money. And campaigns are faster and larger, because the same tools that sped up a state-backed intrusion this fall are rented to ordinary criminals.
The rule: judge the request, not the writing. Unexpected plus urgent means verify. Any voice asking for money or data gets a call back on a number you already have, never the one they give you.
On your side of the inbox, the question is not whether your team uses AI tools. Most of them do, and that is fine. The only question that matters is what goes into the box. The test we give staff: would you email this to a stranger? General questions, formulas, templates, and summaries of public IRS notices are fine. A client's name tied to their finances, SSNs and EINs, returns, payroll files, bank statements, screenshots of firm systems, and anything from the password manager never go into a consumer chatbot. Under IRS Publication 4557, the FTC Safeguards Rule, and IRC Section 7216, pasting that into a consumer tool is a disclosure to a third party, the same as emailing it to a stranger, and most consumer tools keep what you type. Firm-approved tools only, and a review before anyone tries a new one. Our AI adoption page has the acceptable use policy template we use with client firms.
The six habits, and why they are also your compliance evidence
Every briefing ends on the same six habits, and five of them repeat from the previous one on purpose, because habits work by repeating. Work accounts only on the computer your firm manages, never a personal laptop, a family PC, or a phone browser. Approve only MFA pushes you asked for. No one needs your password or code. Report phishing even when unsure. Keep SSNs and account numbers out of chat; files move through the portal. Expect your technology team to verify who you are before a reset or a change.
Those habits are not just good practice. They are the controls the FTC Safeguards Rule and IRS Publication 4557 require a firm's written information security plan to have: multi-factor authentication, encryption and access limits, staff training, an incident response plan, and timely reporting. A team that lives the habits is a firm whose WISP describes reality, and that is the whole point of the WISP.
Report fast. There is no such thing as a false alarm.
The single most valuable behavior in any briefing is this one. Reported in ten minutes, a clicked link means a password reset, every session signed out, the email blocked firm-wide, and a check of what was touched. Most of the time nothing was accessed and nothing has to be reported. Discovered three weeks later, the same click has become forwarding rules, read mail, and maybe a client contacted from your account. Now it is an incident: investigation hours, client letters, and possible IRS and FTC notices. Same click, different clock.
Tell your team what to call about, even if it turns out to be nothing: an MFA push they did not ask for, a link they clicked, a page that asked them to paste a command, a bank-change request, a lost device, client data sent to the wrong person, or a new client who feels off. Then tell them, in those words, that nobody has ever been in trouble for calling.
Take it home
Everything above protects a family too, and these five take under 40 minutes total: agree on a family code word that any urgent call for money has to say first; put a PIN or port-out lock on your mobile carrier account, because SIM swapping is how text codes and resets get hijacked; put a password manager on the family; turn on app-based MFA or passkeys for personal email and banking first, since email resets everything else; and leave automatic updates on, phones included. The FBI's Internet Crime Complaint Center logged 971 SIM-swap complaints and $17.4 million in losses in 2025. Nearly nobody has set the carrier PIN. It takes five minutes.
This article is educational content, not legal, tax, or financial advice. Statistics are drawn from the public reports named above (Microsoft Digital Defense Report 2026, Microsoft Threat Intelligence, Push Security, the IRS Security Summit, and the FBI IC3 2025 report) as of October 2026. Stronger personal measures such as an IRS Identity Protection PIN or a credit freeze carry trade-offs; talk to your own tax preparer before adopting them.
