A few days ago, one of our clients got a phone call that sounded completely reasonable.

The caller said they were from Toast, the company that runs her point-of-sale system. It could just as easily have been Square, Clover, or any other provider. They mentioned the recent news about AI and cybersecurity threats and said they were reaching out to review their clients’ infrastructure. Then came the ask: her firmware was out of date, and they needed her to grant remote access so they could run the updates.

It all sounded professional, timely, and helpful. That’s exactly what made it dangerous.

Why it almost worked

Security news is everywhere right now. Every week there’s another story about AI-powered attacks, new vulnerabilities, and urgent patches. So when someone calls and says, “Given everything going on, we’re checking our customers’ systems,” it doesn’t sound like a scam. It sounds like a company doing its job.

Scammers know this. They take the headlines you’ve been hearing and use them as their script. The more security news there is, the more believable a “helpful” support call becomes.

Even routine updates can become a pretext

This week was Patch Tuesday. On the second Tuesday of every month, Microsoft releases its regular round of security fixes, plus emergency “out-of-band” patches when something can’t wait. It’s about as routine as security gets.

This month’s batch included some serious problems, including a Microsoft Outlook flaw (CVE-2026-124194) that attackers are already using. Opening a specially crafted message can hand over the information they need to go after your Microsoft account. That’s a real reason to make sure your updates are installed.

It’s also a perfect script for a scammer. “Hi, this is IT support. You may have heard about this week’s critical Microsoft vulnerability, and we need to get on your computer to make sure you’re patched.” Every word of that sounds believable because the news behind it is true. The scammer doesn’t have to invent a crisis. They just borrow a real one.

Even the most predictable, expected security events can be turned into a convincing reason to hand over access.

One more quick heads-up for the few of you who run SSH on a home server or anything exposed to the internet: the new OpenSSH hole has been reverse engineered and is being exploited in the wild, so update to the latest patch now. If you don’t know what SSH is, you can safely skip this one.

What she did right

I’ve been talking to this client about these threats for months, and it paid off. Something felt off, so she hung up and texted me.

I told her to look up Toast’s official phone number herself, not to use any number the caller gave her, and to call them directly. She reached her account representative, who confirmed that nobody from Toast had contacted her. It was a social engineering attempt, plain and simple.

If she had granted that remote access, the attacker could have gotten into her business systems, her payment environment, and possibly her customer data.

You can have firewalls, endpoint protection, multifactor authentication, and email filtering, and all of it matters. But no matter how many layers of security you have, a person can still open the door. Attackers don’t need to break your technology if they can convince someone to let them in.

That’s not a knock on anyone. These callers are good at sounding legitimate. That’s the whole job.

The rule: verify everything

If someone contacts you out of the blue and asks for access, payment, passwords, or codes, stop. Hang up, close the email, or ignore the text. Then contact the company yourself using a number or website you looked up on your own, like the one on your contract, your invoice, or the company’s official site.

A real vendor will never be upset that you double-checked. A scammer will push you to act right now.

My one tip: don’t trust anything

No app or gadget fixes this. My tip is simple: don’t trust anything. Not the video, not the phone call, not the text message, not the email. AI can fake a voice, a face, a logo, and a perfectly written message. Verify everything yourself, through a channel you found on your own. That’s the world we live in right now.

The bottom line

The scams that work best are the ones that sound the most reasonable. When a call lines up perfectly with the news you’ve been hearing, that’s not a reason to trust it. It’s a reason to verify it.

Hang up, look it up, and call back. Every time.