How should small businesses verify high-risk requests that arrive by email, voice or SMS?

Why this verification pattern matters for high-risk requests

High-risk requests are the ones attackers most often target because they can move money, change access, or redirect future communications with a single approval. The safe pattern is to make the requester prove themselves through a channel you already trust, rather than through the message that asked for the action. That breaks the attacker’s ability to combine impersonation with urgency.

A phone call back to a known number, a direct check with a directory-listed contact, or an internal approval step changes the decision path from “looks legitimate” to “independently confirmed.” That is why callback verification works better than replying to the same email thread, texting the number that arrived in the request, or trusting caller ID and display names.

For small businesses, this is especially important because the highest-impact scams are often low-friction: invoice redirection, password reset abuse, vendor bank-detail changes, and executive or supplier impersonation. Top 10 Phishing Techniques is a useful companion when you want to understand how callback phishing, BEC and deepfake lures are used to pressure fast approval.

How to separate the message from the decision

The core control is procedural: treat the incoming message as untrusted evidence, then verify the request through a second channel that the sender cannot easily intercept or spoof. In practice, that means using pre-known contact details from your own records, not contact details embedded in the request itself. For vendor changes and payment instructions, the callback should reach a previously established contact, and the approver should confirm the exact change before anything is executed.

For email requests, do not rely on the visible sender name, reply path, or a thread that may already have been compromised. For voice requests, do not rely on caller ID, accent, or confident urgency. For SMS, do not treat a text as a trusted authority channel, because the same mobile number can be spoofed, SIM-swapped, or controlled by an attacker. A separate approver is especially important when the request creates a financial loss, access loss, or a change in payment destination.

This same discipline is why email controls alone are not enough. Authentication helps reduce spoofing, but it does not stop a real mailbox compromise or a convincing fraud message from being acted on. Email Identity and BEC Guide covers the email-side controls that support this process, while TruffleNet stolen AWS keys campaign 2025 shows how stolen credentials can be used to validate or amplify fraudulent payment activity.

Which requests deserve the strongest verification

Not every request needs the same friction. The strongest controls should apply when the request can move money, reset access, alter vendor or bank details, change payroll or tax instructions, or create new authority for a third party. Those are the points where one bad decision can produce immediate and hard-to-reverse harm.

Requests involving executives, finance staff, IT admins, or external suppliers deserve extra scrutiny because they are common fraud targets and often carry implicit trust. If the request is out of band for the person, unusual in timing, or inconsistent with normal business process, assume the channel is part of the attack until a separate verification step proves otherwise. A second approver reduces the chance that one person’s mistaken belief becomes an irreversible action.

When the request is plausibly synthetic rather than merely suspicious, the risk is not only email impersonation. Deepfake audio and video can make voice or live-call verification unreliable if the organisation has not established a separate verification habit. Arup deepfake fraud 2024 is a reminder that a convincing voice or video presence can still drive a disastrous payment decision.

Risk and Threat Considerations

High-risk requests are attractive because they target the point where human trust becomes operational authority. Attackers use email compromise, voice spoofing, SMS fraud and deepfakes to create a false sense of legitimacy, then push the recipient to act before the request can be independently checked.

Failure mechanism: The business accepts the message channel as proof of authority, so a forged or compromised request can bypass normal scrutiny and trigger payment, credential, or vendor changes.

Impact: Losses can include stolen funds, credential reset abuse, vendor bank-detail diversion, mailbox compromise, and follow-on fraud that uses the same trust path again.

Practitioner Guidance

What to prioritise: Put your highest-friction verification on anything that changes money movement, access, or supplier payment details. That is where a single approved action can create the largest blast radius.

What to verify: Use contact details stored independently from the request, and require the verifier to confirm the exact instruction, the amount, the destination, and any urgency claim. If any of those details cannot be confirmed cleanly, treat the request as unapproved.

Decision rule: If the request would be hard to reverse, require both callback verification and a second approver before execution. If the request is routine but still sensitive, keep the callback step and make the approval threshold explicit.

Common mistake: Trusting the same compromised channel to “confirm” the request, or relying on tone, familiarity, or caller ID as if those were authentication factors.

Practitioner takeaway: The safest process is not “spot the fake,” but “make the fake unable to authorise anything on its own.”

Related resources from NHI Mgmt Group

• How should organisations verify high-risk requests that arrive by email?
• How should security teams verify high-risk requests when deepfakes and voice cloning are in play?
• When should organisations treat an NHI as a high-priority risk?
• How should contact centers verify identity for high-risk customer requests?