Tip: make "IT will never call you to enroll MFA" a written rule, and give staff one number to call back
The vishing crews in the Cyber Centre's Oct 28 alert win by sounding like your help desk and rushing people onto a fake enrolment page. Write down that IT never asks anyone to set up a passkey, MFA or password over an inbound call, and publish one internal number or ticket queue employees use to check. On the help-desk side, require a callback to the number on file or a manager confirmation before any MFA reset or new-device enrolment, and alert security when an account gets a new MFA method within an hour of a password change.