SOCIAL-ENGINEERING-DEFENSE5 MIN READ
The Known-Good Callback
Define a known-good callback and explain why caller-provided numbers do not count.
Known-good beats caller-provided. The callback has to leave the attacker's channel. A safe callback source is already trusted: vendor master record, company directory, ticket queue, HRIS profile, contract owner, or official website you navigate to yourself. Caller ID is not a safe callback source. Use the callback to verify the action, not just the person. For payments, confirm amount, account, reason, and approver. For data, confirm scope, legal basis, recipient, and transfer method.
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in