The idea
Out-of-band verification checks a request through a communication path that the request did not supply. For an emailed bank-account change, that could be a phone number from a previously verified vendor record. For a suspicious message from a colleague, it could be the usual internal chat or an existing contact number.
Why it is stronger
If an attacker controls a mailbox, website or text conversation, they can answer follow-up questions inside that same channel. They can also include their own “verification number” in the fraudulent invoice. A separate trusted channel forces the attacker to control an additional route. The person confirming should state the exact requested details rather than simply saying an invoice exists.
Apply it proportionately
Use it for high-impact changes: beneficiary accounts, password resets you did not request, urgent document sharing and unusual approvals. Keep known contact details current so a rushed employee does not search an unverified advertisement. The FBI's
BEC guidance recommends separate communication channels for significant transactions. A call is not automatically safe if you dial a number that arrived in the suspicious email.
