Blog

Who, exactly, is Mark from IT – and how can you tell if he’s really who he says he is?

“Mark” has a few routines, each of which starts with a request that comes across as normal – and completely credible.

• The call: “Hi, this is Mark from IT. We’re seeing an issue with your account, so I’m sending you a verification code. Can you read it back to me?”
• The email: A message to a customer or an employee, asking them to click a link to fix their remote access, or to approve a security update before end of day.
• The payment follow-up: A call to a controller about a payment that “didn’t go through,” with new instructions for sending it again.
• The remote session: “IT needs to install an update on your laptop. Just accept the connection when it pops up.”

None of these requests is strange on its own. People reset passwords, approve updates and fix payment problems all the time. It’s become second nature, and that’s exactly what “Mark” is counting on. He doesn’t need anyone to do anything unusual. He needs them to do something completely normal, but for the wrong person.

Why it works

“Mark” is a fraudster who’s very good at social engineering. He doesn’t break into systems so much as get invited in like a vampire. And once he’s in, he’s still careful to make sure that very little about him and what he does looks wrong.

He has real credentials. After a successful call, “Mark” has a working login and a valid one-time code. To most controls, that answers the question they’re designed to ask: Is this a legitimate user? So they don’t flag his activity.

He uses approved software. Remote monitoring and management (RMM) tools are signed, allow-listed, and expected on corporate machines. When “Mark” connects through one, nothing on the endpoint looks like malware, because it’s not. This is growing more common, with RMM abuse growing 277% year over year, according to Dark Reading.

He starts with the weakest link in the chain: people. In a Q6 Cyber study published in April 2025, 52.3% of ransomware attacks began with compromised credentials, and 19.4% began with a social engineering call. Those are the two things “Mark” specializes in.

How “Mark” gets his tools of the trade

Over Memorial Day weekend in 2025, a Bank of America customer posted publicly about a fraud he couldn’t explain – and worked out what happened before his bank could.

The important detail for any fraud team: The bank’s investigation didn’t uncover the method. the victim did, and handed it to them. The institution’s systems saw a clean, authenticated session. The answer lived on the customer’s own devices, in a feature no one thought to ask about.

How to tell if this is your case

The real Mark invests in certifications. “Mark” invests in tools, most of which he finds on the dark web.

Q6 Cyber’s analysts work inside the restricted fraud channels, forums, and storefronts where those tools are sold. What they find there looks less like a criminal underground and more like any online marketplace, complete with listings, prices, seller ratings and customer support. “Mark” can buy:

• The login. Stolen credentials for business accounts, often filtered by bank, balance or state. A verified account listing sells for as little as $18.
• The code. OTP bot services that call the victim while posing as the bank and collect the one-time code automatically.
• The number and the script. Caller ID spoofing makes the call look like it’s coming from your institution, and tested scripts allow him to credibly pose as a help desk, a new hire, or a controller.
• The access. Remote sessions on compromised corporate machines, sold after someone else has already done the social engineering.

That’s what makes “Mark” so hard to stop. He doesn’t need to be skilled. He needs a budget, and the tools he buys can cost relatively little. But what he takes with those tools will cost the institution hundreds or thousands – and a lot more on a business account.

Why “Mark” goes after business accounts

“Mark” can target anyone, but business accounts are where he gets his best ROI. They carry higher balances and wire access, and a business has a variety of employees who might pick up the phone or open the email.

This creates a huge detection gap for a financial institution. When “Mark” signs in, he’s using real credentials, often from a device the account already trusts. When a payment goes out, the customer may have actually approved it themselves. To fraud controls built to catch malware and unfamiliar devices, “Mark” looks exactly like the customer. By the time anyone notices, the case usually follows a familiar arc: the customer says Mark from IT told them to do it, but a quick check shows they don’t have a Mark in IT.

How to tell the MARKS APART

If “Mark” looks legitimate inside your systems, the clearest view of him is from outside them. Before he makes the call, the login he’ll use, the script he’ll read, and the access he’ll sell are often already listed for sale. Seeing those listings is how an institution learns about “Mark” while there’s still time to act.

That’s what we’re investigating during Cybersecurity Awareness Month:

• Tuesday, October 6, 11:00 a.m. ET: The “Mark” who Calls – Business account takeover and social engineering. Robert Villanueva and Jess Kelley of Q6 Cyber, joined by a member of the U.S. Secret Service Cyber Fraud Task Force, walk through how “Mark” gets into a business customer’s account, what he does once he’s in, and where he can be stopped. Watch on demand.
• Tuesday, October 13: Q6 Cyber CEO Eli Dominitz will be on stage at ABA Fraud & AML Conference for a panel titled “One email could cost you millions: Why banks must rethink BEC controls now” (a wrap-up of the session will follow).
• Thursday, October 22, 10:00 a.m. ET: The “Mark” who Connects – When Legitimate Tools Become Malware. Dima Khrustalov of our threat intelligence team shows how legitimate remote-access software is used to take control of a victim’s computer, and where that access is sold afterward. Our CISO Jake Kruse moderates this webinar.
• Every week: Intelligence from our analysts, with real dark web listings, redacted and dated.
• Also this month: Watch for our ROI report and buyer’s guide.
• End of the month: A wrap-up ofour findings and recommendations to help you spot the “Mark” from IT who’s targeting your customers.

One registration covers all of it. Register for the series here. By the end of October, you’ll know who “Mark” is, what he’s after, and how to stop him.