Some of the world’s biggest financial firms are being targeted by a surprisingly old-school cyberattack: phone calls.

A widespread “vishing” campaign (voice phishing) has targeted large finance companies including Blackstone, KKR and CME Group, with attackers posing as corporate IT or help desk employees. Their goal is to convince workers to provide login credentials, authentication information or other details that can be used to access company systems.

The attacks demonstrate why social engineering remains such a difficult cybersecurity problem. Even sophisticated security technology can be undermined when criminals successfully impersonate trusted employees.

For companies and workers, the takeaway is simple: unexpected requests for passwords, authentication codes or account changes should always be independently verified through established internal channels.