“Please enter 62 to confirm it's you”

The message

A reconstruction. The people, companies, numbers and addresses are fictional.

Work chat · IT Service Desk

Hi 👋 Kyle from the IT Service Desk here. We're finishing the sign-in security upgrade on your account and the system has queued one last verification.

In the next minute you'll get a sign-in prompt on your phone. Please enter 62 in the prompt to confirm it's you so we can close the ticket. Ref INC-20931. Thanks for your patience!

Thirty seconds later, the prompt arrives. It's the real one, from your company's real authenticator app, asking for a two-digit number.

Why it works

Number matching was built to stop a lazier attack. When you sign in, your screen shows a number and your phone asks you to type it, so a prompt you didn't start can't be approved by accident. The attacker's answer is simple: give you the number.

Everything around the request feels like IT. The message arrives in the work chat app you use every day. The account is called "IT Service Desk". There's a ticket reference, a polite tone and an upgrade nobody has time to question. Help-desk messages are supposed to be slightly technical and slightly boring. This one is.

It isn't a one-off. Between January and April 2026, Palo Alto Networks' Unit 42 tracked a campaign that set up outside chat accounts named like internal IT, contacted more than 150 employees at more than 10 organisations, then phoned them and talked them into giving remote access. The version above asks for something smaller: two digits. Two digits is enough. They finish the attacker's sign-in, and from then on the attacker is you: in your email, your payroll portal and your shared drives, with no password alarm going off.

The field marks

• Authority. "IT Service Desk." A title that discourages questions.
• Urgency. "In the next minute." Hurry stops you checking.
• Borrowed trust. A ticket number. A reference makes a request feel like process.
• The ask. Type a number into a prompt you didn't start.

The habit that stops it

Spot the ask. Switch the channel.

The ask is the number. A sign-in number belongs on your own screen, for a sign-in you started. Nobody, including your real IT team, ever needs you to type one in for them.

Then switch the channel. Tap Deny. Phone IT on the internal extension you already know, not a number from the message, and tell them a prompt arrived that you didn't start. It means someone has your password.

Two more habits make it stick:

• Look at who's talking. Most work chat apps mark accounts from outside your organisation as External. Your IT team is never external.
• If you run IT, tell your team in advance, in writing, what you will never ask for. Then it's easy for them to notice when someone does.

Sources

• Spring Ring: voice phishing campaigns targeting enterprises (opens in a new tab), Unit 42, Palo Alto Networks, 2026
• Spring Ring vishing campaign abuses Microsoft Teams (opens in a new tab), Help Net Security, 1 September 2026
• How number matching works in multifactor authentication push notifications (opens in a new tab), Microsoft Learn