Callback verification: why checking via a pre-registered number protects better than any kind of "recognition"
The simplest control in payment security often turns out to be the most reliable. Callback verification needs no expensive systems — only discipline: confirm the request by calling a number the company knew long before the request appeared.
What callback verification is
Callback verification is a procedure in which a request for a payment, a change of bank details or other critical data is confirmed by a return call initiated by the company itself. The call goes not to the number given in the email or message, but to a contact recorded in advance in an internal system — for example, in supplier master data or the employee directory.
The idea is simple: an attacker may control the channel used to send the request, but it is much harder for them to control an independent channel chosen and verified by the company beforehand.
Why "recognition" fails
Many employees are convinced they can tell the real executive or partner "by ear". But recognition is a feeling, not a check. It is easy to fool in several ways:
- a voice can be synthesised from recordings of public appearances;
- the phone number on the screen can be spoofed (caller ID spoofing);
- a real person's mailbox or messenger can be hacked, so a "familiar" writing style proves nothing either;
- under stress and time pressure people tend to "fill in" a familiar image.
A rule worth writing into policy: recognising a voice, a face, a number or a writing style is not grounds for approving a payment. The only grounds is a successfully completed procedure.
Rules for a proper callback
- Numbers come only from an internal source. Master data, the contract, the counterparty's onboarding form — never an email signature or a number dictated during a call.
- The company initiates the call. An incoming call "to confirm" is not callback verification, even if the number matches.
- An independent performer. Ideally the check is carried out by someone other than the employee who received the request.
- Specific questions. Confirm the substance of the request, the amount and the beneficiary account — not a general "yes, it's us".
- Record the result. Who called, when, which number and what was confirmed — all of it goes into a log or the payment record.
- Changing contacts is a separate procedure. Updating a phone number in master data itself requires verification via the old, already known contact.
Common mistakes
Callback verification most often breaks not because of technology but because of exceptions. "The director is on a plane and can't answer", "the supplier has changed all its phones", "it's urgent, we'll check later" — these are exactly the phrases used in fraud scenarios.
Another common mistake is calling the number listed in the very email that announces the change of bank details. If the email is forged, the number in it also belongs to the attacker, and the "check" only confirms the fraud.
A short checklist
- A callback is mandatory for any change of bank details and for payments above a defined threshold.
- Contacts are taken only from master data, which is updated through a separate procedure.
- The company initiates the call, and the result is recorded.
- Skipping the check is not possible, even at management's request.
- An employee who stops a suspicious payment gets support, not a reprimand.
Callback verification works precisely because it does not rely on human intuition. It asks not "does this sound true?" but "has an independent channel confirmed it?" — Sentinel Ledger Editorial
