Response desk

This would expose the work password and current authenticator code to the page operator. A code could be used quickly to attempt a sign-in. Urgency and personal details do not establish authorization.

The reply goes to the address supplied by the same message. A deceptive sender could simply confirm their own request. Use a separate, previously trusted contact route.

This provides independent verification. Preserve M02 and report it through the approved channel. Do not supply the password or code, and do not use the questionable message’s contact details.

“We did not send M02. There is no travel revalidation deadline for Alex. The sender domain and destination are not approved Northbridge services. Please preserve the original message and report it through the bookmarked employee portal.”

This response was obtained through the trusted directory, not by replying to M02.

Immediately notify the real help desk through the trusted route and explain what was entered and when. Stop interacting with the page. Use the known legitimate portal to change the exposed password, following IT instructions. IT should revoke active sessions, review sign-ins and account changes, and reset affected authentication methods as needed.

Do not assume an expired code or a password change alone ends every session. Preserve the message and timeline. If the password was reused elsewhere, change it there too through each service’s trusted route.