Post

This is awesome, and lovely, and old, but offset by the observation that amazon will still let you sign up with someone else's email address.

Same habit works for company IT. When a caller says they're a locked-out employee and wants a reset or a new MFA device, call back on the number already on file, not one the caller gives. Caller ID shows whatever the attacker chooses to send.