Practical Verification Guides
Short, situation-based checks for suspicious messages, calls, identities and account requests.
These guides are designed for the pause between contact and action. They do not require proving that a sender is malicious; they replace the sender’s route with an independent one.
Verify a person without using their message
- Do not call the number, open the link or use the account named in the request.
- Find a route you already trust: a saved number, official app, staff directory, card or statement.
- Describe the request without forwarding sensitive codes or documents.
- For family or work requests, ask about a detail the caller did not supply.
Read a suspicious message
IdentityWho does the sender claim to be, and can that identity be checked elsewhere?
PressureWhat changes if you wait ten minutes or ask another person?
RouteDoes the request move you to a new site, app, number or payment method?
ActionAre you being asked to reveal, approve, install, pay or keep the exchange secret?
Check a job offer
- Confirm the role on the employer’s own careers page.
- Check whether the recruiter writes from the employer’s domain.
- Expect a real conversation about duties before payroll or identity paperwork.
- Never pay to unlock earnings, equipment or a job.
- Treat checks followed by a request to return money as a fake-check pattern.
Check a support request
- Close pop-ups and reopen the official app or known website yourself.
- Do not approve an MFA prompt you did not initiate.
- Do not disclose one-time codes to a caller.
- Ask what ticket or event exists in the official account history.
- End unexplained remote access before changing passwords.