Your Callback Is Only as Trustworthy as the Contact Record Behind It
Independent verification depends on how a phone number became trusted. Build a usable contact directory with ownership, change checks, and fallback routes.
The finance team follows its rule: before changing a supplier’s payment details, someone calls the number in the supplier record. The call confirms the change. On paper, the verification looks independent. But the phone number was updated from the same email that requested the new bank account.
This is a fictional example, not a report of a particular breach. It exposes a practical dependency: a callback does not become trustworthy merely because it uses a telephone. Its value depends on where the number came from, how changes are controlled, and whether the person reached can confirm the specific instruction.
A contact directory is therefore more than an address book. For sensitive workflows, it is part of the evidence behind a decision. The useful question is not simply “Did we call?” It is “Why did we trust that route, and what did the call establish?”
- Keep the verification route separate from the request being verified.
- Record who owns a contact and how important changes were confirmed.
- Plan for a departed employee, an unanswered number, and an unavailable directory.
- A successful connection does not by itself establish the speaker’s authority.
The overlooked change is often the contact change
The FBI’s 2021 notification on business email compromise affecting government entities recommends using telephone numbers already on file rather than numbers supplied in an email. It also explicitly includes contact-information changes among the changes organizations should verify. The publication concerns government targets, but that distinction is useful when reviewing any supplier workflow.
Our analysis here extends that principle into a proposed directory-management process. It is not an official checklist or a claim that one record format guarantees protection. The right controls depend on the consequences of a wrong decision, the organization’s staffing, and the systems available.
The FBI’s broader BEC guidance also supports independent verification of payment requests. That independence can disappear if the new request is allowed to redefine the channel used to verify itself.
Separate an ordinary address book from an approval directory
A sales representative may keep dozens of informal contacts. That is useful for ordinary communication, but it does not mean every number should authorize a bank-detail change. A directory supporting sensitive decisions should identify the purpose for which a route was established.
For example, an account manager may answer delivery questions but lack authority to approve a payment-destination change. A service desk may accept an incident report but cannot authorize a contract amendment. Store the relevant role and scope, not just a person’s name and a green “verified” label.
Avoid turning the directory into an unnecessarily detailed personal dossier. Collect business contact information needed for the workflow and protect it appropriately. If a personal number is genuinely necessary for an agreed emergency role, restrict access and follow the organization’s privacy arrangements rather than distributing it in a general spreadsheet.
What a useful record contains
| Field | Purpose | Common mistake |
|---|---|---|
| Organization and business relationship | Connect the route to the correct supplier or partner | Confusing similarly named companies |
| Role and permitted confirmation | Explain what this contact can establish | Treating any employee as an approver |
| Established contact route | Support a check independent of a new request | Copying a number from the disputed message |
| Record owner and deputy | Give someone responsibility for maintenance | Assuming everyone owns a shared directory |
| Verification and change history | Show why the current route is trusted | Overwriting the old value without explanation |
| Fallback route | Handle absence or an unavailable primary channel | Inventing a shortcut during an emergency |
The record need not be elaborate. A smaller, maintained directory can be more useful than a huge collection of stale numbers. Start with the relationships and decisions where misdirection would have serious consequences.
Establish the first route before the urgent request
New suppliers present a genuine problem: there is no historical contact to call. Handle initial verification as part of onboarding, while there is time to establish the business relationship and authorized roles. Do not treat a new supplier’s first urgent payment email as the whole onboarding process.
The organization should decide which independent business records and established contacts support that initial check. A public company listing may help identify the legal entity, but it does not automatically authorize a particular employee or bank account. Several copies of the same unverified information do not become independent evidence simply because they appear in different files.
Record the outcome and the person responsible for the decision. If evidence is incomplete, say so. “Pending verification” is more informative than a trusted label added because the system requires a completed field. The process needs an explicit route for resolving that pending state.
Do not let a maintenance request approve itself
Suppose a partner says its finance contact has changed. That may be entirely legitimate. The directory owner should use the existing established route or another approved independent process to confirm the replacement, rather than asking the new contact to certify their own authority.
If the old route no longer works, this is an exception to resolve, not a reason to trust the incoming message automatically. The team may need help from the business relationship owner and other established records. Keep consequential changes on hold until the organization’s required evidence is available.
Preserve a proportionate history of the change: the previous role or route, the new one, the confirmation method, the date, and the accountable person. Apply the organization’s retention rules. A record should support later review without exposing unnecessary personal data to everyone who uses the directory.
Make stale information visible
A number that was reliable two years ago may now reach a different department or no one at all. The directory should distinguish a maintained route from an old entry whose status is unknown. A review date is a prompt to check, not a promise that the number remains safe until a particular deadline.
Choose review frequency according to the relationship and risk. A frequently changing contractor team needs different maintenance from a stable service provider. Staff departures, mergers, contract renewals, and returned calls can all trigger a review rather than waiting for a calendar reminder.
Give directory users a simple way to report a failed or suspicious contact. Do not ask them to silently replace the entry with a number they found in a search result. Our analysis of support numbers in search answers explains why convenient discovery is not the same as an established verification route.
The conversation still needs a defined purpose
Reaching an established number is one part of the check. The caller also needs to explain which business instruction requires confirmation and reach an appropriately authorized role. A receptionist confirming that someone works there does not necessarily confirm a requested payment destination.
Keep the conversation within the legitimate workflow. Never ask a contact to disclose a password, one-time code, or unrelated confidential information as proof. Use the organization’s approved process to confirm the relevant change and record the result without unnecessarily repeating sensitive details in general notes.
If the answer is ambiguous, record it as unresolved. “They said it sounded right” should not be converted into “verified.” A useful callback can reveal that more work is needed; it does not have to end in approval to count as successful verification.
Build a fallback that does not collapse under urgency
The primary contact may be on leave. The directory application may be unavailable. The payment deadline may be approaching. Decide in advance who can handle these conditions, which alternative routes are acceptable, and who may authorize any exception within their role.
The UK’s NCSC incident-management guidance emphasizes available key contacts and deputies in response planning. A related practical design question for this directory is whether an authorized person can reach the right counterpart when the normal working environment is disrupted.
If a protected offline copy is justified, assign an owner, update process, and access rules. An old printout is not automatically safer than a digital directory. It can become stale, be misplaced, or omit recent changes. Test the actual fallback rather than assuming that a file labeled “emergency contacts” solves availability.
Run a contact-record exercise
Use fictional records, not a real payment or surprise call to a supplier. Give a team a routine instruction with one change: the named contact has left. Ask them to show the approved route for finding a replacement and the point at which the transaction would pause.
Then ask a different employee to repeat the process using the documentation. If success depends on one person’s memory or private address book, the directory has not yet become a dependable team resource. Record the missing information and assign a repair owner.
Check permissions too. Can someone who requests a sensitive change also rewrite the trusted contact record without review? Our piece on independent evidence in two-person approval explains why adding a second approver does not help when both rely on the same unverified input.
The measure of success is a usable independent route
Count unresolved and stale records, time needed to reach an authorized contact, and exceptions that bypassed the expected route. Avoid rewarding the team simply for making more calls. A call to the wrong person or a self-approved replacement number can produce activity without adding confidence.
Most importantly, make it acceptable to stop when the route cannot be established. A directory should help legitimate work continue with clear evidence. It should not create a ritual in which an employee must mark a box even when the person, number, or authority remains uncertain.
The callback rule is sound only when its supporting records are maintained. Protect the way a contact becomes trusted, the way it changes, and the way staff use it under pressure. That is what turns “we called someone” into a meaningful independent check.
Found a factual error or a source that has changed?
Send a correction →
