Independent callbacks

An unexpected contact should be verified by rebuilding the route from a source the contact did not supply. A familiar voice, organization name, or caller ID display does not create that independence. Caller ID can show a familiar organization or number even when a scammer placed the call.¹

For an unexpected account-security call, the FTC recommends contacting the institution through its official app or website, a recent statement, or the number on the card. It advises against using a callback number supplied by the caller, displayed by caller ID, or included in the message.² A search for customer service is not automatically independent either. Paid advertisements can place fake service numbers near the top of results.³

The diagram shows how the source of a callback number determines whether verification leaves the caller-chosen route.

flowchart TB
    A[Unexpected contact] --> B{Choose verification route}
    B --> C[Number from contact]
    C --> D[Caller-chosen channel]
    B --> E[Known-correct number<br/>on card, official app,<br/>or recent statement]
    E --> F[Independent channel]

Figure: A number known to be correct creates a separate verification route from the contact's chosen channel.

In practice, a bank customer can end the call and use the bank's app or the number printed on a card. Someone receiving an emergency request can call or message the relative through a previously known number. If that person cannot be reached, FTC guidance recommends contacting another relative or friend, even when the caller demanded secrecy.⁴ Canada's revenue agency similarly tells recipients to end an unexpected call before checking a supplied callback number rather than checking while the caller remains connected.⁵

This recommendation is untested. The fetched guidance does not include a controlled or field study measuring whether independent callbacks reduce consumer losses. It is recommended as a way to control the verification channel, not as a proven loss-prevention rate.

Boundary. The judgment does not hold when the new route comes from the original message, caller ID, or an advertisement found during the incident. A successful callback also verifies only the party reached. It does not establish that every part of the original story is true. The available sources do not quantify callback failures when a scammer also controls a phone, browser, or search results.