What is the recommended action when you identify a series of fraudulent calls from someone posing as a member of your agency?

• A. Do nothing
• B. Confirm identity and share information
• C. Document details, review security procedures, and report to appropriate authorities
• D. Block the number

Answer: (C)

When you suspect fraud from someone pretending to be a member of your agency, respond with a structured incident-handling approach. The best action is to document all details of the calls, review your security procedures to see where the impersonation could have succeeded or could be prevented in the future, and report the incident to the appropriate authorities or your agency’s security team.

Documenting details means capturing what was said, the times and dates, caller IDs, numbers dialed, and any requests for sensitive information. This preserves evidence that can support investigations and help identify patterns. Reviewing security procedures helps you pinpoint gaps in verification, data handling, and access controls so you can tighten controls, update training, and prevent recurrence. Reporting to the right authorities ensures the incident is formally investigated, helps protect others, and creates a formal record for accountability and potential legal action.

Blocking the number might stop the immediate calls, but it doesn’t preserve evidence, address underlying vulnerabilities, or trigger a formal investigation. And confirming identity and sharing information with the caller would be dangerous and could expose sensitive data.