If someone calls saying they're from your IT help desk and you need to set up a new login right now, hang up. Then call IT back on the number you already have.
Canada's cyber agency is warning that this exact call is being used against Canadian businesses, and law firms have been hit hardest lately. Some big Bay Street firms have already said client files were accessed.
What happened
On October 28, 2026, the Canadian Centre for Cyber Security (Canada's cyber agency) issued an alert about an ongoing phone scam aimed at Canadian organizations. It's been going on through 2026. Since July it has been hitting finance and legal firms more, and in October it focused on law firms.
The caller pretends to be from your company's IT help desk. They say there's an urgent change: a new sign-in method, a password reset, or setting up the code-on-your-phone sign-in step. Calls can come to a cell phone, an office line or Microsoft Teams, and the caller ID can be faked to look like your real help desk. They may mention real IT staff by name, or a "deadline you missed."
According to The Logic, McCarthy Tétrault found an incident on October 22 and told affected clients on October 25. Bennett Jones, Borden Ladner Gervais and Davies also said some files or accounts were compromised. McCarthy Tétrault's own statement calls it a "co-ordinated social engineering campaign," meaning attackers tricked people rather than breaking the technology.
What this means in plain English
The caller sends you to a web page that looks like your company's sign-in page. It even has your company name in the address. When you type your password and the code from your phone, the page passes them straight to the real Microsoft 365 sign-in, live, while you watch. It's like someone standing between you and the bank teller, repeating everything you say.
So the code on your phone doesn't save you here. The attacker is logged in as you.
Once in, the alert says they add their own phone or device as a way to sign in, so they keep access even after you change your password. They delete the security warning emails so you don't see them. Then they copy files out of SharePoint and OneDrive (Microsoft's online file storage) and demand money not to leak them.
Why a small business should care
Law firms are the current focus, but the alert says the target list has moved around all year. Any office using Microsoft 365 email and files fits the pattern. Small offices often know their IT person by voice, which is exactly why a confident caller using that person's name works.
Who's affected
Canadian organizations of any size, with legal and financial firms targeted most recently
Anyone signing in to Microsoft 365 with a password plus a code or approval on their phone
What to do: everyone
If someone calls about your password, sign-in or phone codes, don't do anything during the call.
Hang up. Call your IT help desk back on a number you already have, not one the caller gives you.
Never type your password or a phone code into a page someone sent you to over the phone.
If you already did, tell IT right away. Speed matters more than embarrassment.
Report suspicious calls to whoever your office has named for that.
What to do: if you run the business
Set a simple rule: IT will never ask you to sign in or set up a code during an unexpected call. Tell everyone.
Give staff one clear person or number to report odd calls to.
Ask your IT provider about sign-in methods that can't be relayed by a fake page, like physical security keys or passkeys tied to a specific device. The alert recommends these.
Make sure there's a real check before anyone's sign-in method gets reset.
Questions to ask your IT provider
Would we get an alert if a new phone or device was added to someone's sign-in?
Can we block sign-ins from devices we don't manage?
If someone fell for this today, how fast could you lock them out and remove the attacker's device?
Sources
Canadian Centre for Cyber Security: Alert AL26-028: Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
The Logic: Bay Street law firms say hackers accessed information related to clients
McCarthy Tétrault: Statement from McCarthy Tétrault
Contact Nautalex to see how we can help you with protecting your staff from phone scams.
