Authority signals can be forged
Every marker of authority can be faked: the logo, the signature block, the job title, the domain that nearly matches, now the voice.
None of them constitute verification, and all of them are treated as if they did. The only reliable check is confirming through a channel the requester did not supply, which is why that single habit defeats such a wide range of attacks.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- Security friction moves behaviour elsewhereSqueeze it here, it comes out there
- MFA fatigue weaponises repetitionAsk forty times
- Verify suspicious requests through a separate channelRing back on a line they never gave you
- People need a safe way to report mistakes quicklyThe shortest road back