Verify Out of Band
Why not just reply and ask if it is genuine?
The idea
Confirm an unexpected request through a different channel than the one that made it.
In the real world
Phoning a supplier on a known number after an email changing their bank details.
Going deeper
Replying to a suspicious message sends your verification into the channel the attacker already controls, so they answer their own check. This is why prompt confirmation of a fraudulent request proves nothing.
Out of band means a route you chose independently: a phone number you already held, a contact reached through a directory you maintain, a person spoken to directly. The rule is most valuable where it is made standard in advance — payment detail changes always confirmed by call to a stored number — because deciding to verify in the moment is exactly what urgency is designed to prevent.
Where it stops applying
Out-of-band verification adds friction to legitimate changes and needs a maintained list of known-good contacts. It is worth reserving for actions that move money or grant access.
Why it matters
An attacker controlling one channel cannot usually control the one you choose independently.
Try this today
Agree with your team that payment changes are always confirmed by a call to a stored number.
Test yourself
An email from a known supplier gives new bank details. Replying to ask for confirmation gets a prompt yes. Why does that prove nothing?
Show the answer
The reply goes back into the channel the attacker already controls, so they answer their own verification. Only a route chosen independently — a number you already held — reaches the real supplier rather than whoever is sending the emails.
Learn this in the feed Answering from memory, then again days later, is what makes it stick.