A tale from the Keep, invented but true to life.
The Treasurer of Hollowmere trusted her routines the way other folk trust locks: the great ledger left open on her desk, three strongroom keys at her belt, and the same familiar faces at the gate, day after day, in the busy weeks before harvest tax.
On a gray afternoon, a man in the Stonewrights’ colors came to that gate with a scroll bearing the Steward’s seal. “The Steward sent for us,” he told the guards. “Seven weaknesses in the walls and strongrooms, and orders to mend them before the frost. He wants it done today.”
The guards knew those colors. The Stonewrights had mended Hollowmere’s walls for years, and no one thought to send a runner to the Steward to ask. They waved the guild’s envoy up to the counting house.
He bowed to the Treasurer. “Forgive the interruption, my lady. I’ll need to inspect your strongroom records.”
She glanced at the window. A summons from the Duke’s court had come that morning, and she was already late. The envoy saw it. “Go,” he said gently. “I’ll finish quickly and lock the room behind me. You have my word.”
She had no time to send word to the Steward, and nothing about the man seemed wrong. She left the ledger open and went.
When she returned, the envoy was gone, and with him the names of all three strongrooms, the keepers of each, and the hiding place of the spare keys, which she had noted in the margins. It had all been there for anyone who sat down in her chair. Nothing had been broken. Every door had been opened by someone who was let in.
He was no thief. The colors were borrowed and the seal was a copy, both made with the Steward’s blessing. The Steward had hired him to learn whether his own castle could be fooled, and the envoy had written down every step so the weaknesses could be mended before a real enemy found them.
In the real world
The attack here wasn’t technical. It borrowed three things people rarely question: a trusted name, an official reason, and a deadline. Defenses that work:
-
Verify out of band, and make it normal. If a vendor says management sent them, confirm through a number you already have, never one they hand you. Leadership has to say openly that checking is expected, even when the visitor wears a name you trust, because if checking feels rude, people won’t do it.
-
Lock the session when you walk away. An unlocked screen is an open strongroom. Short auto-lock timers help, and so does a habit of locking on the way out.
-
Limit what one open session can reach. Credentials shouldn’t sit where anyone at that desk can find them.
This technique is called social engineering. Organizations hire professionals to test for it, so the weaknesses are found by someone on their side first.
