Choose a reading path

I want to understand manipulation

Begin with pretexting and the trust chain, then manufactured urgency. The first explains how a request becomes plausible; the second explains how the time available to question it gets removed. Neither requires a security background.

I want to understand identity

Read why a familiar voice is not proof alongside what phishing-resistant MFA does and does not solve. The useful distinction is between a person who sounds familiar, a device that authenticates and an action that is actually authorized.

I run a team or help desk

Start with help-desk identity checks, then reporting without blame. Read the two together: strong verification needs a workable exception process, and a workable process needs people to report uncertainty without fear.

I follow current developments

Our news analysis section works from dated primary records. Read the EvilTokens analysis for the relationship layer of account compromise and the passkey-themed lure briefing for the gap between a security label and an authorized request.

I need to report an incident

This is an information publication, not an incident-response desk. Use the official reporting directory and your bank, platform or employer’s established contact route. An editorial contact form cannot revoke sessions, freeze funds or preserve a provider’s logs.