I used to work in IT for a local credit union. One day, we start getting calls from several branches with roughly the same question.
Branches: “Hey, there’s a guy here from [Company], and he says he’s here to look at the printers. Is he cleared to do this?”
While this is following process for unscheduled visits, it happens to about five branches in the same area and it is the same tech showing up. We start talking to our manager, and just as he’s getting to a point where he’s going to have us tell the branch to call the cops, one of my coworkers gets off the phone.
Coworker: “Hey, guys, I was just talking to [Manager #2] at [Branch]. She said the tech gave her a card and he’s supposed to be doing this? Like, they’re actually a security company of some kind that does tests like this to make sure people are following protocol.”
Manager: “[Coworker] and [My Name], go talk to [Security Engineer] and see if he’s aware of this. For now, if we get any more calls, continue to have branches follow the process of turning him away. If [Security Engineer] isn’t aware, we’ll call the cops.”
My coworker and I head around the corner and into the engineer’s office.
Security Engineer: “Hey, guys, what’s up?”
Me: “We just wanted to check in because we’ve gotten calls from several branches saying they’ve got an unauthorized vendor onsite looking to inspect the printers. So far, we’ve told them to follow process and turn him away because we can’t verify the visit.”
Coworker: “But I just got off the phone with [Branch], and they said the tech gave them a card that showed he worked for a different company and that they did this kind of thing to test security.”
Security Engineer: “He wasn’t supposed to do that!”
[Coworker] and I just blink at him.
Security Engineer: “Yes, this was scheduled through us—” *meaning the security team* “—but the tech wasn’t supposed to tell him who he was! The branches were going to be notified at the end of the day. He should have hit all the branches we asked him to by now, but if you get any more calls, have them follow process.”
[Coworker] and I start walking back to our seats.
Me: “Did they send us any sort of notice that this was going on?”
Coworker: “I have no idea.”
We get back to our desks and tell our manager what happened. He starts looking through his email.
Manager: “They didn’t tell me.” *Heavy sigh* “All right, that’s fine. Like he said, if we get more calls, have them follow process. I’ll go talk to security and let them know if they do it again, they need to tell us.”
Me: “I mean, you’d think it would be smart to at least warn IT that this is going to be happening, so we don’t, you know, tell the branches to call the cops because there’s a random guy trying to get in!”
Manager: “Yeah, I know. I’ll handle it.”
We hadn’t had another instance like that by the time I left. But sometimes I wonder what was going through the security team’s heads that they thought NOT telling IT they were running this test was smart, especially since we were the ones who would get those calls in that situation and we would check tickets and system for visits. It would have been simple to send us an email that said, “Hey, we’re running an experiment/test, and if the stores call about an unauthorized vendor from [Company], he’s supposed to do this. Don’t tell them who he is; just remind them to follow process and turn him away.”
