Call-back checks for small teams

A call-back check means ending the call and ringing the person yourself, on a number you already trust. It works because it doesn't ask you to judge a voice. It just changes who controls the line.

Why hanging up is the point

The FBI's advice is to hang up. Then look up the contact details of the bank or organisation said to be calling, and call that number directly.¹ The advice is aimed at banks and similar bodies. The same habit suits a colleague or a manager.

Why not simply ring the number that called you? Because of caller ID spoofing, a method by which callers can change the name or number shown to the person they're calling.² Pressing "call back" on a spoofed number could put you straight back through to the scammer.

Australia's cyber agency gives similar advice about banks: call them on the official number from their website.³ It also says always to check who you're communicating with before giving them information.³

Where the number should come from

A good number is one that existed before the call.

• Your own phone's saved contact for that person.
• The staff list or contact sheet your business keeps.
• A supplier's number from an earlier invoice, contract or their official website, never from the message you've just received.
• The bank's number printed on your card or shown on its website.

A bad number is anything handed to you in the call, in an email that arrived with the request, or in a chat message from an unknown account.

A routine for a small team

Small businesses can't run a security department. A one-page routine is enough if people actually use it.

• Decide which requests always need a call-back. Payments to new accounts, changes of bank details, gift cards and password resets are sensible starting points.
• Keep an up-to-date contact sheet, stored away from email.
• Say who can approve what. If the owner is away, who steps in?
• Let anyone say "I'll ring you straight back" without needing permission.
• Write down what happened when a check caught something. It helps new starters.

What to say

People worry most about the awkward moment. Short scripts help.

• "I'm in the middle of something. I'll ring you back in a couple of minutes."
• "Our process is that I confirm payment requests by phone. It's nothing personal."

Keep your voice friendly. A real manager should understand the care. If they get angry about a quick check, note that down and tell someone else in the business.

What doesn't work as a check

Asking questions only the real person should know can help, but it isn't foolproof. The FBI advises not sharing sensitive information with people you've only met online or over the phone.¹ The UK's NCSC says criminals use information about you that's available online, including on social media, to make their phishing messages more convincing.⁴ A call-back doesn't depend on any of that.

A second approver and a shared code word add further layers. Read agreeing a code word or second check for how they work and where they fall short.

If a check fails and the number doesn't answer, escalate to someone else in the business. Don't pay in the meantime. And if you think you've been targeted, the reporting guide lists the agencies to tell.