department of our company and on a particular person's team (I knew that manager). She said she was trying to complete a project for the manager that involved reporting structures for my department's ex-US organization (I can't remember the details of what she told me). She said she was behind schedule and was supposed to have completed this already for her boss but that the company internal directory for that part of the organization was out of date — she asked me if I could fill in the gaps for her.

I actually started describing our function's ex-US structure but luckily I didn't get into anything confidential before I started to be suspicious. I asked her again for her name and extension and specifically what she needed the information for and told her I could gather what she needed and call her back or email her. She gave me an extension and then hung up quickly. The extension turned out to go to someone else and I couldn't ever find a record of this person.

I still have no idea what the person was looking for or could have done with the information. Perhaps the real target for their phishing was some lower-level person outside the US and they were just trying to get persuasive sounding information from other staffers like me to help them leverage that for some bigger scam. Maybe they were actually just trying to map our ex-US structure to pick off personnel they could hire. I felt a little silly that I had started to go along with their requests at first but was glad that had caught on rather quickly and shut things down.

Another time I had someone approach a security door with their arms full of stuff and ask if I could hold the door. I asked to see their badge before letting them in, and they mumbled something about leaving it in their office. I told them they would need to go back and get it before they could access this building. They walked to a car in the parking lot, got in and drove away.