When attackers target trust instead of technology, organizations must respond with verification habits and empowered staff.