VairogsPasswords, MFA, Smart-ID, and secret codes
What must never be shared, even when the other person sounds convincing.
The employee distinguishes secure authentication from a situation where they are being used as an access gateway.
Threat
Stolen credentials and social engineering remain frequent paths to initial access.
What to know
- Passwords must be unique. If one password is reused, one leak can compromise several accounts.
- MFA is not a magic shield if you approve someone else’s sign-in or read out a code.
- In Smart-ID and mobile authentication prompts, check the action, amount, recipient, and timing.
- Signal, WhatsApp, email, and backup recovery keys should be treated like passwords.
Actions
- Use a password manager, or at least unique passwords for critical accounts.
- Never tell anyone a one-time code, PIN, Smart-ID code, or recovery key.
- If you receive an unexpected MFA request, deny it and report it.
- If in doubt, call a previously known number, not the number included in the message.
Workplace scenario
Code-sharing risk
Someone calls claiming to be from IT support. They know the employee name, project, and manager, and ask for a one-time code to “finish a check”.
Think before the test
- Why do known names and projects not prove the caller identity?
- How can the employee stop the call politely and verify the request?
- What should happen if a code was already shared or approved?
For the manager and responsible person
Managers and finance staff need stricter controls: unique passwords, MFA, and a second-person review for payments.
- Set a clear rule: nobody asks for codes, PINs, or recovery keys.
- Document how employees verify IT support requests.
- Give separate instruction to finance and management account users.