Skip to content

Verify who you are really talking to

In short

Switch channels. Get back in touch through a route you already had before this message: the number on the back of your card, the one saved in your contacts, the official app. Checking by replying to the message means asking the stranger to confirm they are who you think.

Why this works

No sign you receive proves an identity, because they can all be reproduced: an email's display name is a free-text field, a text message's sender is just a label, a caller's number can be spoofed, a profile photo can be copied. Even a genuine account can be compromised, in which case the message really does come from the right account. What stays out of the attacker's reach is not a sign but a route: the one you choose yourself.

Step by step

  1. Break off the exchange

    Hang up, don't reply, close the conversation. Nothing you are being asked to do stops being valid in ten minutes, and someone who claims otherwise has just told you something.

  2. Choose a route that predates the message

    The test is the date: the number must have been in your hands before the request arrived. The back of your bank card, a long-saved contact, a paper bill, the official app installed from an app store.

  3. For someone close to you, call, don't write

    A message from a “new number” is checked by calling the old one, not by writing to the new one. If no one answers, call someone else in the family. A voice is still, for now, harder to imitate than text — but bear in mind that voices can now be cloned: a question only the real person can answer is still useful.

  4. At work, follow the procedure rather than your judgment

    Two-person approval of a transfer exists for the days when the message is convincing. Suspending it “just this once” is exactly what the fraud asks for; applying it never needs justifying.

The most common mistakes

  • Calling back the number shown by the incoming call: it can be spoofed.
  • Replying to the message to ask for confirmation: the answer goes to the attacker.
  • Treating an accurate detail about you as proof: it often comes from a data breach.
  • Not checking out of politeness, when checking never has to be announced as a doubt.
  • Calling back straight away without hanging up properly: the line can stay open.

The attacks this defeats

Official sources

Other guides · Last updated: 2026-09-02.