Verify a support caller before granting remote access

Separate identity from urgency

A caller may know your company, device model or an employee's name and still lack permission to support your computer. Information from public websites, leaked records or previous messages can make a story sound convincing. The key decision is whether the person and requested action can be verified independently.

A real support task should survive a short callback through a known channel. Do not let a claimed emergency erase the steps that normally authorise administrator access.

Verify the request before opening tools

1. Ask for the organisation, person's name, ticket reference and the precise problem. Record them without disclosing passwords, recovery codes or private customer details.
2. End the unsolicited call. Use the support number from your existing contract, company directory or a previously verified website. Do not call only the number the caller supplied or rely on caller-ID text.
3. Confirm that a real ticket exists, that the named technician is assigned and that remote access is part of the approved work. Check who inside your organisation authorised the action.
4. If verified, use the established remote-support method and observe the session. Approve elevation only for the expected task. Stop if the technician requests unrelated banking access, secrecy or transfer of security codes.

Verify the end of the session

Confirm the connection is closed, any temporary access is removed and the technician records the work in the ticket. A closed application window does not always mean unattended access was removed. Ask the responsible administrator to inspect the installed support agent or access grant when its status is unclear.

If access was already granted

Disconnect the remote session through the approved controls and report what occurred. Record which applications were opened, whether elevation was approved and whether secrets were shared. Use a separate trusted device for account recovery if the computer may be affected. Avoid immediately erasing all evidence just to make the machine look clean.

Build a repeatable routine

Keep the callback directory current and practise the process with staff. Include legitimate after-hours support in the procedure so users are not forced to improvise. The goal is a verifiable authorised session, not a test of whether a caller sounds professional.