Out-of-band verification

Confirm a high-risk request through a channel the requester did not choose, using contact details you already held.

The detail matters. Calling the number in the email reaches the attacker. Calling the number in your own records reaches the person. It is one control, it is cheap, and it defeats business email compromise, deepfake voice calls and most payment fraud at once.