Someone calls saying they are from IT. They know your company’s name, sound confident, and say a security problem needs immediate attention. All you need to do is enter a support code and let them connect.
Remote support is a normal part of keeping a business running. It lets technicians troubleshoot problems without traveling to your office. But the same convenience can help an impostor if you grant access before confirming who is asking.
For Knoxville and East Tennessee businesses, the practical lesson is simple: verify the person and the request before handing over control.
Real software can be used for the wrong purpose
In research published September 29, 2026, Microsoft described campaigns observed in July that used misleading meeting invitations, document-themed messages, and update prompts to distribute a legitimate remote-management installer. Attackers then used that access to install a second remote-access tool, ScreenConnect, giving themselves another route into affected computers.
Microsoft said it did not observe exploitation of ScreenConnect itself in this activity. The issue was attackers abusing legitimate software to obtain and maintain access.
That distinction matters. Recognizing a product name or seeing a familiar connection window does not establish that the person operating it is authorized. A legitimate tool can be used by a legitimate technician—or by someone pretending to be one.
Verify through a channel you already trust
If a support request surprises you, pause the conversation. Contact your IT provider using a number saved in your company directory, an existing support agreement, or another independently established contact.
Do not use a callback number supplied in the suspicious message or a number displayed in a frightening browser pop-up. The FTC also warns that scammers may advertise fake support services in search results.
Ask your provider to confirm the request and identify what work is expected. A ticket number can help them locate a real issue, but a caller quoting a number is not proof on its own.
CNS customers can use (865) 219-9949 to check an unexpected request. Save your established support contact where employees can find it quickly, including when their computer is unavailable.
A chat message deserves the same scrutiny as a phone call
An IT-themed message inside a familiar application can feel more trustworthy than an email. Microsoft’s September 2 research described attackers impersonating help-desk staff through external Microsoft Teams contact and persuading users to approve remote assistance.
Pay attention to external-contact labels and warnings. A familiar display name, company logo, or helpful tone should not replace independent verification.
For a small business, we recommend a simple habit: unexpected requests to install software, approve remote control, or override security warnings should be checked with your established IT contact before proceeding.
Watch for requests that do not fit the job
Pressure is a warning sign. Be cautious if someone insists you cannot call your normal IT contact, demands secrecy, or says you must act immediately to prevent a catastrophe.
Requests to open personal banking, move money, purchase gift cards, or provide account credentials should raise immediate concern. The FTC identifies unusual payment demands as a common feature of tech-support scams.
Ask how the requested action relates to the problem. If a routine printer issue turns into instructions to disable protection or install an unfamiliar program, stop and verify the change.
CNS’s remote-support entry point is support.uscns.com. Use it after confirming the support request. Visiting the correct website does not, by itself, establish that a caller or a particular session is legitimate.
Already granted access? Report it promptly
End the suspicious session and contact your IT provider from a separate, trusted device. If the person still has control, disconnect the affected computer from its network while you arrange help.
Write down the time, the caller’s details, and what you remember doing. Keep relevant messages and screenshots if you can do so safely. Avoid deleting software or wiping the computer yourself before IT can assess it.
Closing a support window may not remove everything installed during the session. Tell IT if you entered passwords, approved sign-in prompts, opened financial accounts, or saw additional software being installed.
Use a trusted device to change exposed passwords, with IT’s help for work accounts. Your provider may also need to review active sessions and other account changes. If money or payment information was involved, contact your bank promptly.
Make verification easy for your team
We recommend keeping approved support contacts readily available and practicing this scenario in a short staff discussion. Employees should know whom to call and feel comfortable reporting a mistake quickly.
Remote support remains a useful business tool. A brief verification step helps make sure the person receiving access is the person you intended to invite.
Have a suspicious support request or want help establishing a verification process? Contact CNS through your usual support channel.