Verify suspicious requests through a separate channel
The separate channel is the whole of the control.
It does not require detecting anything or being suspicious of the right things. It works even when the message was perfectly convincing, because the verification does not depend on judging the message. Building it into the process, rather than leaving it to individual caution, is what makes it reliable.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- Security friction moves behaviour elsewhereSqueeze it here, it comes out there
- MFA fatigue weaponises repetitionAsk forty times
- People need a safe way to report mistakes quicklyThe shortest road back
- Security training decays without practiceWhat you knew in March