Vericode vs the old ways

The alternative to calling back a client should preserve what makes a proper call-back work.

Good verification returns to a trusted contact point. Vericode makes that step fast, repeatable and documented, without relying on shared secrets, a familiar voice or the same mailbox that delivered the instruction.

Try Now See how the check works

Same objective, different mechanics

Independent confirmation is the part worth keeping.

Calling back, asking security questions, recognising a voice and requesting an email reply all try to answer the same practical question: should staff trust the person behind this high-risk instruction? Each method can add useful context. They differ in how independent the signal is, how easily it survives pressure and what evidence it leaves after the interaction.

Vericode uses possession-based verification. A code goes to the mobile number already on file, not to the contact details supplied in the suspicious request. It adds a recorded check during the live conversation, but it does not replace an independent call-back or confirmation of the complete instruction.

Honest comparison

Five ways to handle the moment before staff act.

Method	Time cost	When and how it fails	Evidence left
Call back on a known number	Several minutes, plus time to find and independently confirm the right number.	Strong when staff use a number from a trusted source and confirm the complete instruction. It weakens when records are stale, the number comes from the suspicious message or urgency causes the step to be skipped.	A file note or call log if someone records it; the call itself does not create structured evidence of what was checked.
Security questions	Usually quick, although staff must choose questions and judge the answers.	Answers may be exposed in breach data, previous correspondence or public profiles. A knowledgeable impersonator can sound convincing without controlling the client's trusted device.	Usually a note that questions were asked, with limited proof of the challenge or outcome.
Voice recognition	Immediate and effortless.	Familiarity is subjective, and cloned or imitated voices can exploit it. Recognition is not verification.	None beyond a person's recollection or file note.
Email confirmation	Fast when everyone is already in the same thread.	A reply through the same mailbox adds little assurance when that mailbox is the compromised channel. Thread history and genuine details can remain visible to an attacker.	A searchable message trail, but not independent evidence that the real client controlled the reply.
Vericode	About 10 seconds during the live interaction, without ending the call.	Uses an independently held trusted phone number. It can still fail safely when the number is stale, unavailable or the result does not match, so staff must stop and escalate rather than treat uncertainty as success.	A timestamped record of who requested the check, the masked target number, method and outcome, with hash-chained register events.

Where the old ways hold up, and where they do not

Keep useful context. Add an independent signal.

Call-backs are good practice when they are done properly

A call-back to a number independently confirmed from a trusted record remains a sound control. It separates the check from the number or link supplied in the request and gives staff a chance to read the complete instruction back. The operational problem is consistency: finding the source, ending the call, redialling and documenting the outcome creates friction precisely when a client says the matter is urgent. Vericode adds a quick, recorded code check beside that practice; it does not replace a call-back or confirmation of the complete instruction.

Security questions test knowledge, not possession

Dates, addresses, employers, family details and familiar matter facts are often available across public social profiles, breached datasets and compromised correspondence. Avoiding easily researched questions helps, but staff still have to decide whether an answer is persuasive. Instead of relying on security questions, return to a trusted contact point that was established before the suspicious interaction. Possession gives the check an independent signal rather than another piece of shared knowledge.

A familiar voice is not a control

People naturally use tone, vocabulary and context to recognise someone they know. That instinct can support a conversation, but it should not authorise a consequential change. Voice cloning makes the gap explicit: a voice can sound familiar while the speaker remains unverified. Our deepfake voice guide explains why recognition is not verification and how a separate challenge fits into a practical response.

Read the deepfake voice cloning guide

A compromised mailbox can confirm its own fraud

Email is useful for creating a written record and exchanging routine information. It is not an independent confirmation channel when the concern is business email compromise. An attacker inside the mailbox may see the history, reply in the established thread and use genuine client details. Confirming the instruction through the same account can therefore preserve the appearance of continuity without changing who controls the conversation.

See the hacked-email withdrawal pattern

Business email compromise often turns genuine correspondence into cover for a false instruction. For the broader attack mechanics, read our guide to business email compromise.

Evidence by default

Make the procedure visible after the call.

Each check is logged with who requested it, the masked target number, its time, method and outcome. Authorised-contact register events also form a per-contact hash chain. Compliance-authorised users can export the record as PDF or CSV.

That record does not claim the payment details were correct or that every customer action was verified. It shows that a defined possession check occurred against the trusted phone number, giving reviewers more than an unstructured note that someone sounded right.

Choose the right layer

Old habits are not the only controls Vericode complements.

KYC and VOI establish identity at onboarding. Vericode addresses the later interaction, when a consequential request arrives and staff need to know who controls the trusted phone now.

Compare Vericode with CDD and KYC Compare Vericode with KYC/VOI tools Explore the verification workflow