Ignoring instructions can cause a lot of trouble, especially when you’re making decisions for an entire office.

That’s what one IT worker dealt with after a manager ignored several warnings about a change to employee logins.

When the change took effect, she called complaining that the required app cost $40 and wouldn’t let anyone sign in.

The problem was that she’d picked the wrong app, and her employees had already entered their passwords into it.

But instead of listening when he explained the risk, she insisted he didn’t need to escalate it. Meanwhile, security was already disabling the office’s accounts.

Read on to see what happened next.

Helicopter Managers. The bane of my existence. Or. No mam, MS Authenticator is free. It does not cost 40 dollars.

Not too long ago, we switched 2FA to MS Auth, as the other one was less secure and we kept having annoyance intrusions. Annoyance intrusions are what my job calls them.

Person A has their account creds compromised, and a 3rd-party actor tries logging in. They are hit with 2FA and decide to try their luck. The person who owns the account thinks nothing of it and ignores the prompt or hits no.

The 3rd-party actor tries again and again until the person finally gets annoyed and hits yes to shut their phone up.

The whole thing started after they switched to MS Auth.

After years of dealing with these kinds of intrusions, we convinced the higher-ups to switch to MS Auth. Actually, that’s a lie. MS Auth is cheaper, and that’s how we got them to approve the switch.

Anywho, we made the swap last year, and we kept running into something I call Helicopter Manager Syndrome.

The manager would set up his/her entire staff on the 2FA for them. They would not have their workers grab the MS Auth app from the Play/App Store. They would just set it up for them and use secondary authentication methods, i.e., text/call methods.

There were some drawbacks to the new system.

Welp, fast forward to this year, and new security policies are in place. Malicious 3rd-party actors are able to intercept calls and text messages, logging into accounts and compromising our network.

Now it is app-only. If you forget your phone? Guess you gotta drive home. Your phone is lost/stolen/destroyed in a horrible paddle boat accident? Gotta get a new phone.

Now I tell you that story to tell you this story.

Let me introduce you to HMS (Helicopter Manager Syndrome) Karen. Karen is a manager of over 150 underlings whom she treats like her children. Her perfect little angels need her to do everything for them.

The manager on the phone had quite the reputation.

See, since the plague wiped out most of humanity and we all started to live in underground bunkers, or just permanently worked from home, HMS Karen was always a bit extra when it came to her hovering.

If one of her underlings called into the help desk, she had to be three-wayed onto the call.

Her staff needs warranty work? Better write up a 4,000-word essay to explain why, or she won’t approve it. Actually, that one was easy, as managers don’t approve warranty work and cannot interfere with that.

HMS Karen was the manager no one wanted to work under, yet was the only choice due to location.

Of course, the woman tried to wait until the last moment to make the change.

So the day comes when we send out the warning email stating that text and call methods will NOT work for logging into our systems any longer.

Then the second warning. Then the third… Yup, all ignored.

So finally, the day of the switchover comes, and HMS Karen is calling into us, frantic. By this point, Karen has lost over 60 percent of her underlings due to the economy.

$HMS Karen – You have to undo the change. We cannot use this horrible app.

$Me – Thank you for calling IT. This is Lightning. How may I assist you?

The call was awkward from the start.

Small silence.

$Me – Hello?

$HMS Karen – Can you hear me?

$Me – Yes, I can hear you now. Thank you for calling into IT. This is Lightning. How may I assist you today?

$HMS Karen – I just… Never mind. You have to undo this horrible change. We need to be able to text to log into our accounts. This app is horrible.

From the way she described it, they had the wrong app.

$Me – I understand it can be a bit of a pain to set up, but once it’s up and running, it is good to go.

$HMS Karen – NO, it’s not. It’s popping up with full-screen ads and not letting us authenticate to log in.

$Me – Uhh…

$HMS Karen – And it costs 40 dollars. Do you know how expensive it is for me to pay 40 bucks for 47 employees?

$Me – Well, I have some good news there. It is actually free. If the app you have is saying it costs 40 dollars, it is not the correct app. Also, MS Auth does not have any ads. So that is not the correct app. You don’t have to pay for it.

Frustrated, he tried to explain it to her.

$HMS Karen – That isn’t true. I am looking at it right now on the Play Store. It’s called the Authenticator App. It has a lock with a keyhole in it.

$Me – Ma’am, MS Auth is free. It does not cost 40 dollars. The one you are looking at is a fake provided by a malicious 3rd party trying to steal your login creds.

Long pause.

$Me – Have any of your guys tried to log in to the app?

$HMS Karen – They tried, but it wouldn’t work with the QR code prompts from the logins.

To confirm what he just heard, her reiterated what happened.

$Me – So you are telling me that all of your employees have entered their UN and PW into this app?

$HMS Karen – They tried to, but it doesn’t let them log in.

$Me – But they physically entered the info—

$HMS Kraken, interrupting me – I JUST SAID IT WOULDN’T LET THEM LOG IN!!! WE DO NOT NEED TO ESCALATE THIS!!!!

While having this conversation, I am on our chat programs with the security department.

The security department was not impressed.

$Me – Hey… I am on with office 999. You know HMS Karen’s office?

$Sec – … Don’t ruin my day, please.

$Me – You know those fake apps that are charging 40 dollars and stealing accounts?

$Sec – … Thank you for reaching out to the security department. No one is available to take your call at this time.

$Me – Bro…

Apparently, it had been an issue the whole day.

$Sec – OK. Yeah, we know the app. It’s been all day with this crap.

$Me – So you know how HMS Karen is the most helicopterist helicopter to ever copter her underlings?

$Sec – English, please?

$Me – I’ll order us some Wingstop. But yeah, her entire office bought this 40-dollar app and entered their creds into the app.

$Sec – … Didn’t I just tell you not to ruin my day?

At this point, Karen was really upset.

$Me – Shut up. I’m paying for Wingstop.

$Sec – OK. I’ll get on the horn with Karen’s boss and the CIO. Let them know that Jimmies are about to be rustled.

Right around this time…

$HMS Kraken – DID YOU JUST DISABLE MY ACCOUNT!!!

$Me, talking really fast – Per security policies, I have informed the security department of the possible intrusion. Everyone in your branch has had their accounts disabled for their protection. If any of your employees use their company PW for any of their non-work accounts, it is suggested they immediately change it.

They all jumped on a call together.

In my chat with security, the CIO was invited in, as well as Karen’s boss.

$CIO – Hey, invite me into this call.

$Ultra Karen – Yes, me too, please.

SO I invite security, the CIO, and Karen’s boss into the call and “accidentally” disconnect myself from it.

$Me – Oh, guess I accidentally transferred instead of added. CIO, you have the call now.

Luckily, it all worked out in the end.

$CIO – OK. That works for me. Mistakes happen. Not like you could have done any more anyways.

In a private message from CIO:

$CIO – Smooth.

HMS Karen’s entire office was down that day, and it took the security department 4 hours to set up their office on the correct MS Auth app. Cherry on top: CIO ended up footing the bill for the buffalo wings. Although he ordered from BWW instead of WingStop. Not my cup of tea, but I won’t complain about a free lunch.

Wow! It’s so crazy that many people fell for the same scam.

Let’s see what Reddit readers think about the whole thing.

Your employees should not have to be babysat.

There are several apps for 2FA.

That’s a good point.

If you enjoyed this story, check out this post about an IT employee who thought a ticket was closed, only to hear otherwise from the client’s manager.

Here’s someone who almost ran into that very thing.

She was so busy doing everything for her employees that she created a problem for all of them.

A quick call to IT before paying for that app could’ve saved everyone a lot of trouble.

And then, even after he explained what happened, she still thought she could decide whether security needed to know.

At any rate, it’s a good thing he contacted them instead of wasting more time arguing with her.