Okta Social Engineering Impersonation Report - Response and Recommendation
Summary
Okta has identified an increase in phishing social engineering attempts claiming to be from Okta Support. This report provides guidance on what you can expect when getting technical assistance from Okta Support, or contact from Okta. If you receive suspicious contact claiming to be Okta, please promptly inform Okta Security at security@okta.com.
What can you expect?
In the event a support case is open, Okta Support may contact you by phone or email. The Okta Support call will include an initial validation process for authorized representatives by both phone and email. Okta Support will not ask for your password or for an MFA token.
In the case of a significant security-related concern, Okta customers will receive a rapid communication alert. Rapid alerts will only be received by your organization’s security & privacy contact(s) and primary IT contact(s) via the information in their respective profiles, which must be up-to-date to successfully communicate with you.
Okta may contact you from the following verified channels:
1. Email
Okta Support emails will be from support@okta.com or support@auth0.com and Okta emails will be sent from noreply@securityalerts.okta.com or noreply@okta.com.
2. SMS
Text alerts are sent from SMS numbers or short codes that may vary by country. In the US, they are from 893-61.
3. Phone
Initial contact from Okta may come from the following channels, with follow-up contact directly from the individual(s) managing the case. Okta phone calls will come from +1 415-915-9255. Okta Support phone calls vary by region:
In North America, from +1 800-219-0964 or +1 855-243-9894,
In APAC, from +61 1800 951 247, and
In EMEA from +44 808 169 7176.
What can you do?
Social engineering scams prey on urgency and emotional reaction. When receiving suspicious, unsolicited contact, be vigilant of the following common indicators of social engineering:
Suspicious email address
A social engineering sender will often imitate the address of a legitimate business or organization however some characters may vary, be omitted, or misspelled.
Urgency and emotional response
Recognizable signs of an attempt include urgency and manipulation of an emotional response as tactics. In these cases, social engineering attackers may use time-sensitive situations and/or a narrative to invoke an emotional response with the goal of coercing impulsive decisions.
Spelling, grammar and layout
One of the most obvious indicators is a message with poor sentence structure, improper grammar and incorrect spelling. In some cases, the layout including formatting of the message is irregular. It should be noted that with the emergence of AI technology, spelling and grammar errors are not always obvious, or even present.
Suspicious links or attachments
Unsolicited email or SMS messages including attachments or links should be verified prior to opening, especially if the messaging involves a sense of urgency.
For more information on how to protect yourself, your workforce, your business and your customers, read up on Okta’s Ultimate Guide to Phishing Prevention.
How to report Okta Impersonation Attempts?
If you come across a suspected impersonation attempt of Okta or Okta Support as a customer, please promptly raise a customer support ticket or inform Okta Security by email at security@okta.com.