Out-of-Band Verification (Callback Rule) is a security control mapped to NIST CSF 2.0 PR.AA-03 and CIS Control 14 (Security Awareness and Skills Training). It helps small businesses reduce breach risk, including from AI-enabled attacks, and answer the security questions that insurers and clients ask.
Out-of-band verification means confirming a sensitive request through a different channel from the one it arrived on. If an email, call, text, or video call asks you to send money, change bank details, or share a password or login code, you hang up and call back on a number you already have on file. The person making the request never gets to choose how you check it.
AI has made this habit essential. Voice cloning and real-time video tools can make a request sound and look like it comes from your owner, your bookkeeper, or a long-time vendor, so recognizing a voice or face is no longer proof of who is asking. The FBI's December 2024 public service announcement on generative AI fraud recommends exactly this: hang up, look up the organization's number yourself, and call it directly.
For businesses, the rule pairs with dual approval. Changes to vendor bank details and payments above a set amount need a second person, and the first payment to new details waits until a callback confirms the change. The FBI's September 2024 business email compromise (BEC) announcement likewise advises using secondary channels or two-factor authentication to verify requests to change account information.
The same rule protects logins. A caller asking the help desk or an IT provider to reset a password or enroll a new multi-factor authentication (MFA) device should be called back on the number on file before anything changes. In NIST Cybersecurity Framework (CSF) 2.0 terms, this is authenticating the requester before acting (PR.AA-03), and CIS Controls v8.1 Safeguard 14.2 calls for training staff to recognize social engineering such as business email compromise and pretexting.
Cyber insurance applications commonly ask whether you confirm payment and bank-detail changes by calling a known number, and policies that cover social engineering fraud may expect that procedure to have been followed. Check your own policy wording and make your callback rule match it. If you have no coverage for this kind of fraud, the rule matters even more, because the loss is entirely yours.
The losses are large, and AI is part of them. The FBI's 2025 Internet Crime Report recorded more than $3 billion in reported business email compromise losses, and businesses reported more than $30 million in losses to BEC scams involving AI. A callback costs a few minutes and works however convincing the fake is.
Apply the callback rule to help desk requests as well as payments. A caller asking to reset a clinician's password or enroll a new MFA device should be called back on the number in your staff directory before anything changes. Requests to change where insurer reimbursements or vendor payments are deposited deserve the same check.
FinCEN's November 2024 alert (FIN-2024-Alert004) warned financial institutions about fraud schemes that use deepfake media, including fake identity documents used to get past identity verification. Treat a voice or video call alone as insufficient for authorizing wires, account changes, or credential resets, and confirm through contact details already on file.
Retailers pay many suppliers, so a message announcing a supplier's new bank details is a classic setup for payment diversion. Confirm every change by calling the supplier on the number in your vendor file, and hold the first payment until the change is confirmed. Store managers should also verify any urgent call from 'head office' asking for gift card purchases or cash transfers.
Public contract awards and vendor lists can tell an impersonator who you pay, which makes a fake banking-change request easier to time. Apply the callback rule to every vendor banking change and record the verification alongside the change. Contractors handling CUI should apply the same callback to requests for credential or MFA resets, since those accounts are the path to CUI.
Write a callback rule: any request to send money, change bank details, buy gift cards, or share a password or login code is confirmed by calling back on a number already on file
Never use contact details supplied in the request itself, even when the voice, face, or email address looks familiar
Require a second person's approval for vendor bank-detail changes and for payments above a set amount, and hold the first payment to new details until a callback confirms it
Apply the same callback to help desk requests for password resets and new MFA device enrollment
Brief staff with realistic examples (a cloned voice, a familiar face on a video call, a vendor email with new bank details) and run a short drill once or twice a year
Report attempted or successful payment fraud to your bank immediately and to the FBI's Internet Crime Complaint Center at ic3.gov
NIST CSF 2.0, Protect: PR.AA-03
NIST Cybersecurity Framework 2.0CIS Control 14: Security Awareness and Skills Training
CIS ControlsOut-of-band verification means confirming a sensitive request through a different channel from the one it arrived on. If an email, call, text, or video call asks you to send money, change bank details, or share a password or login code, you hang up and call back on a number you already have on file. The person making the request never gets to choose how you check it.
Cyber insurance applications commonly ask whether you confirm payment and bank-detail changes by calling a known number, and policies that cover social engineering fraud may expect that procedure to have been followed. Check your own policy wording and make your callback rule match it. If you have no coverage for this kind of fraud, the rule matters even more, because the loss is entirely yours.
Write a callback rule: any request to send money, change bank details, buy gift cards, or share a password or login code is confirmed by calling back on a number already on file Then, Never use contact details supplied in the request itself, even when the voice, face, or email address looks familiar Then, Require a second person's approval for vendor bank-detail changes and for payments above a set amount, and hold the first payment to new details until a callback confirms it Then, Apply the same callback to help desk requests for password resets and new MFA device enrollment Then, Brief staff with realistic examples (a cloned voice, a familiar face on a video call, a vendor email with new bank details) and run a short drill once or twice a year Then, Report attempted or successful payment fraud to your bank immediately and to the FBI's Internet Crime Complaint Center at ic3.gov.
See how this control stops real-world attacks, including AI-enabled scams:
Want to know how your organization measures up on this control?
Start the free Quick Check