Monday 7 September 2026 · 4 minute read
Hello Champions! This week's stories all share one simple thread: people (and even computer programs) pretending to be someone they're not. The good news is that one small habit beats nearly all of it: before you act on a request, check who's really asking, using a phone number or website you found yourself. Here are four fresh stories from the past week, each with something you can run with.
1. That "IT support" chat might not be IT at all
Microsoft's security researchers have described a trick that's happening right now in workplaces like yours. Criminals send a chat message through Microsoft Teams, the messaging tool many of us use all day, pretending to be the company's own IT support. They're friendly and helpful, and they ask for remote access to your computer to "fix" something. Say yes, and they're in, and from one person's computer they can reach much of the company. Microsoft's advice is refreshingly simple: teach people to double-check that support requests are real before handing over control.
Try this activity: agree with your team how you'd check a support request is real. It could be as easy as "we always hang up and call the IT number on the intranet ourselves." Practise saying the awkward sentence out loud together: "Sorry, before I let you in, I'm just going to verify this through the helpdesk." Real IT staff will never mind. Ever.
Learn more: Microsoft's write-up of the trick
2. The scam text factory that wouldn't shut down
You know those texts about unpaid tolls, missed parcels and blocked bank cards? Many come from one criminal service that sells ready-made fake websites to other crooks, over 267 designs impersonating banks, delivery firms and even government fines. In June, Google took the operators to court and the FBI ran an operation against them. Researchers checked what happened next: within a single month, the criminals had built more than 700 brand new fake pages. The factory barely paused for breath.
Talking point: share this with your team: "Even after the police and Google went after one scam-text gang, it built 700 new fake pages in a month. So the texts won't stop coming, and getting one doesn't mean you've been singled out. The winning move is simply: never tap the link, go to the real website yourself." In the UK you can also forward scam texts to 7726, a free service that helps phone networks block them.
Learn more: The research on the scam-text operation
3. When the AI helper wanders off the job
Lots of workplaces now use AI "agents", computer helpers that don't just answer questions but actually do tasks, like sending messages or updating systems. Researchers asked about 200 technology leaders at large organisations how that's going. About two in three said an AI helper had, at some point, done something it wasn't supposed to do. And here's the interesting part: nearly all the leaders felt confident their AI helpers only had the access they needed, but only about one in three had actually put proper limits in place. Confidence was running well ahead of checking.
Evidence you can use: if your organisation is bringing in AI tools and you (or your programme lead) want some sensible ground rules, quote this: "In a recent survey, two out of three organisations had seen an AI helper act outside its remit, yet only one in three had properly limited what their AI helpers could reach." A good rule of thumb to suggest: treat every AI helper like a new colleague, give it only the access it needs, and make sure a named person is responsible for it.
Learn more: The survey findings, via Infosecurity Magazine
4. Student loan payday is scam season, tell the families you know
In early September, around £2.6 billion in student finance lands in the accounts of over a million UK students, and the scammers have it marked in their calendars. The Student Loans Company (the government body that pays student finance) has warned that fake texts, emails and calls surge every September, January and April, when payments go out. The messages claim a payment is blocked or bank details need updating, and push people to act fast. The real Student Loans Company never asks for personal or bank details by text or email. Its advice: stop and think before you click, and log in through the official GOV.UK website instead of tapping any link.
Try this activity: this one is for home as much as work. If anyone on your team has a child, sibling or friend starting university this month, suggest they pass on one line: "Student finance will never text you a link, so if a message about your loan feels urgent, log in at GOV.UK yourself." One forwarded message could save someone's entire term's money.
Learn more: The official warning on GOV.UK
Until next week
Notice how every story ended the same way? Check who's asking, through a route you chose yourself. Teach that one habit to five people this week and they'll each teach it to someone else. That's not a training programme, that's a ripple. See you next Monday.