Call back on a number you already hold
This is the habit that appears most often in the sources behind this course, in one form or another. Scamwatch: phone the supplier using contact details you already have, never a number in the email, and call a friend or family member back on their real number. The FBI: independently find a phone number for the person and call to verify. The US Federal Trade Commission: contact the organisation using a phone number, website or email address you know is real, not the contact details in the unexpected message.
Why it works: the scammer controls the message, including any phone number in it. They do not control the number already in your files, your phone's saved contacts or the number printed on a bank card. If a "new number" or "new bank account" arrives, the check is to go back to the old, trusted record.
Remember
Facts and sources for this part
- The same advice is to phone the supplier using contact details you already hold or found independently, never a number listed in the suspicious email. [KS4]
- Scamwatch says to always call a friend or family member back on their real number, and not to reply to a message from a new number claiming to be them. [KS7]
- Scamwatch says to check an organisation that called you by calling back on a number you find yourself on its official website or app. [KS7]
- The FBI says to verify the person contacting you by independently finding a phone number for them and calling to check, not by using the number or details they gave. [KS15]
- It says to contact the organisation using a phone number, website or email address you know is real, not the contact details in the unexpected message. [KS23]
A second channel and a code word
If someone you know contacts you from a new platform or number, the FBI says to verify the new contact through a platform you had already confirmed or another trusted source. INCIBE tells companies to confirm an urgent payment request through a different channel, such as a call or an internal message, and to confirm the identity of contacts by direct phone or in person, especially for sensitive operations.
The FBI also suggests a secret word or phrase agreed with family members to verify identity. Our advice: teams that handle payments can agree something similar, for example a phrase for phone approvals that is never written in email or chat and is changed now and then. A code word is a backup, not a replacement for the callback.
Remember
Facts and sources for this part
- The FBI says that if someone you know contacts you from a new platform or number, you should verify the new contact through a previously confirmed platform or trusted source. [KS15]
- INCIBE's checklist says to confirm any urgent payment request through an alternative channel, such as a call or an internal message, and not to let urgency pressure you. [KS34]
- INCIBE advises confirming the identity of contacts through another known channel, such as a direct phone line or in person, especially for sensitive operations. [KS36]
- The FBI suggests agreeing a secret word or phrase with family members to verify identity. [KS14]
Two-person approval
Scamwatch suggests considering a multi-person approval process for payments above a set dollar amount. INCIBE recommends a dual-control rule in which two people authorise transfers above an amount, and payment procedures that need at least two people or two different channels, such as email and phone. After a voice-clone case, INCIBE recommended that payments be authorised by email or in person, never by phone alone.
Our advice: make the second person truly independent. They should check the details against your own records, not against the message that asked for the payment, and they should be free to say no to a senior person. If the person asking is the second approver, you do not have two people.
Remember
Facts and sources for this part
- Scamwatch suggests considering a multi-person approval process for payments above a set dollar amount. [KS4]
- Its checklist also recommends a dual-control rule, where two people authorise transfers above a set amount. [KS34]
- INCIBE recommends payment procedures that need at least two people or two different channels, such as email and phone. [KS34]
- After that case INCIBE recommended that payments be authorised by email or in person, never by phone, and that larger payments need more than one person. [KS35]
Slowing down urgency
Almost every scam in this course adds a clock. The US Federal Trade Commission says scammers want you to act before you have time to think and may tell you not to hang up so you cannot check their story. It adds: do not believe anyone who says you have to quickly move your money to protect it. INCIBE says the attack plays on urgency, trust and fear of disobeying a superior. The Australian Cyber Security Centre's advice is short: if something feels urgent or unusual, stop and verify it.
Our advice: treat urgency itself as a red flag. A simple rule is "urgent plus money or codes equals a second check". Give staff written permission to pause any such request, and to say "I will call you back", without needing to explain why.
Remember
Facts and sources for this part
- The US regulator says scammers want you to act before you have time to think, and on the phone may tell you not to hang up so you cannot check their story. [KS19]
- It adds: do not believe anyone who says you must quickly move your money to protect it. [KS23]
- INCIBE says the attack plays on urgency, trust and fear of disobeying a superior, so the payer makes the transfer without checking. [KS34]
- The Australian Cyber Security Centre advises staff to stop and verify when something feels urgent or unusual. [KS11]
- The US regulator's Spanish-language advice: resist the pressure to act immediately, because legitimate businesses give you time to decide. [KS40]
Make it safe to report
The UK National Cyber Security Centre says that staff who fear for their jobs will not report mistakes, and that a positive culture turns staff into an early warning system. Our advice: thank people who report a suspicious message, including people who clicked. The faster a team hears about a bad link or a bad payment, the more can be stopped.
Remember
Facts and sources for this part
Scenario 1: a phone call
Dana (a senior manager, invented) phones Marcus in finance: "Marcus, release the $22,000 payment to the new supplier now. I've already approved it, no need to wait for the second signature. We'll lose the contract if it's late." The voice sounds right and the caller ID shows Dana's mobile.
Red flags: A senior person asks you to skip the second approval; A deadline with a threat (losing the contract); A phone call only, with no written trail, and a caller ID that can be faked.
What to do: Say: "I'll call you straight back." Hang up, call Dana on the number saved in your own phone or company directory, and ask her to confirm. Do not skip the second approver. If the request is real, the normal steps cost minutes; if it is not, you have saved the money.
Remember
- A senior person asks you to skip the second approval
- A deadline with a threat (losing the contract)
- A phone call only, with no written trail, and a caller ID that can be faked
Facts and sources for this part
- The US regulator says scammers want you to act before you have time to think, and on the phone may tell you not to hang up so you cannot check their story. [KS19]
- INCIBE's checklist says to confirm any urgent payment request through an alternative channel, such as a call or an internal message, and not to let urgency pressure you. [KS34]
- Its checklist also recommends a dual-control rule, where two people authorise transfers above a set amount. [KS34]
- After that case INCIBE recommended that payments be authorised by email or in person, never by phone, and that larger payments need more than one person. [KS35]
- The FBI says to verify the person contacting you by independently finding a phone number for them and calling to check, not by using the number or details they gave. [KS15]
Scenario 2: a phone call
A caller says he is "Mr Chen" from a regular supplier. He explains the bank change email from this morning was sent in error and asks you to ignore the first email, but the "correct" new account number is in a second email he is sending now. He gives you a number to call him back "on his direct line".
Red flags: The caller supplies the number you are told to use to verify him; Two conflicting emails about bank details in one day; He is steering you towards the new account.
What to do: Do not use the "direct line". Hang up and call the supplier on the number already in your supplier file. Ask for your usual contact. Make no change to bank details until the check is complete and a second person has approved it.
Remember
- The caller supplies the number you are told to use to verify him
- Two conflicting emails about bank details in one day
- He is steering you towards the new account
Facts and sources for this part
- The same advice is to phone the supplier using contact details you already hold or found independently, never a number listed in the suspicious email. [KS4]
- Scamwatch says to always call a friend or family member back on their real number, and not to reply to a message from a new number claiming to be them. [KS7]
- Scamwatch says to check an organisation that called you by calling back on a number you find yourself on its official website or app. [KS7]
- The FBI says to verify the person contacting you by independently finding a phone number for them and calling to check, not by using the number or details they gave. [KS15]
Scenario 3: a chat message
A manager, Elena, gets a voice note and a message on a messaging app from her director: "I'm stuck at the airport and my card was declined. Please pay this hotel invoice for a client today, I'll explain tomorrow." Her team has an agreed rule: any payment request that arrives by voice note or chat must be confirmed on a call to a saved number with the team phrase.
Red flags: A payment request through voice note or chat, outside normal channels; An unusual story that cannot be checked quickly; A request to skip explaining or following the usual steps.
What to do: Apply the team rule: call the director on the saved number and ask for the team phrase. If the call is not answered, wait or ask another senior person; do not pay on the strength of a voice note. Log the attempt for the team.
Remember
- A payment request through voice note or chat, outside normal channels
- An unusual story that cannot be checked quickly
- A request to skip explaining or following the usual steps
Facts and sources for this part
- The FBI says that if someone you know contacts you from a new platform or number, you should verify the new contact through a previously confirmed platform or trusted source. [KS15]
- INCIBE's checklist says to confirm any urgent payment request through an alternative channel, such as a call or an internal message, and not to let urgency pressure you. [KS34]
- The FBI suggests agreeing a secret word or phrase with family members to verify identity. [KS14]
- INCIBE advises confirming the identity of contacts through another known channel, such as a direct phone line or in person, especially for sensitive operations. [KS36]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
A caller says the bank-change email was a mistake and gives a "direct line" to call him back. How should you verify him?
Show the answer
Right answer: A, Phone the supplier on the number in your own supplier file. The number supplied by the caller cannot be used to check the caller. [KS4]
Question 2 of 3
Why should the second approver check details against your own records, not the message that asked for the payment?
Show the answer
Right answer: C, The message may be the fake, so checking against it proves nothing. Checking a fake against itself only confirms the fake. [KS34]
Question 3 of 3
Someone tells you that you must quickly move your money to "protect" it. What does the US Federal Trade Commission say?
Show the answer
Right answer: A, Do not believe them; anyone who says this is a scammer. Real organisations do not ask you to move money to keep it safe. [KS23]