Confirming who you are talking to.
WHY IT MATTERS
Acting on instructions from an impostor causes real harm: stolen domains, transferred accounts, exposed data.
WHAT MAKES IT HARD
Legitimate customers find verification annoying, and pressure to be helpful is constant.
WHAT TO ESTABLISH
A policy stating what verification is required for what action.
WHAT LOW-RISK ACTIONS ARE
General questions, with no account change.
WHAT HIGH-RISK ACTIONS ARE
Password resets Changing contact details Transferring anything Refunds Access to data
WHAT TO REQUIRE FOR THOSE
Verification proportionate to the risk.
WHAT COUNTS AS VERIFICATION
A code sent to the registered contact Details only the holder would know Authentication through the account itself
WHAT DOES NOT COUNT
Knowing the account name Sounding confident Urgency
WHY URGENCY SPECIFICALLY
It is the primary tool of anyone attempting fraud.
WHAT TO TRAIN STAFF ON
That pressure is a warning sign, not a reason to hurry.
WHAT TO SUPPORT THEM WITH
A policy they can point to, and management backing.
WHAT TO NEVER DO
Make an exception because the person is angry.
WHAT TO LOG
Every verification, and every action taken on an account.
