How to Verify an Urgent Request Before You Act

An unexpected call, text message, or email may appear to come from your bank, Microsoft, a utility company, a government agency, your employer, or even a family member.

The caller may know your name, address, workplace, or part of an account number. The message may display a familiar logo, and caller ID may show the organization’s real name.

None of that proves the request is legitimate.

Scammers can imitate caller ID, copy logos, compromise real accounts, and obtain personal information from data breaches or public sources. Their most effective tool is often not technology—it is pressure.

The safest response is simple:

Pause, end the original contact, and verify the request through a separate channel you control.

Recognize the Pressure Pattern

Be suspicious when an unexpected contact combines urgency with instructions to:

• Send money immediately
• Move funds to “protect” them
• Buy gift cards or cryptocurrency
• Pay by wire, bank transfer, or payment application
• Reveal a password or one-time verification code
• Install remote-access software
• Open an attachment
• Follow a login or payment link
• Keep the situation secret
• Stay on the phone while completing the instructions
• Avoid speaking with your bank, employer, family, or regular IT provider

The story may involve supposed fraud, unpaid taxes, a suspended account, an expiring service, a utility shutoff, a compromised computer, or a family emergency.

The details change, but the pressure serves the same purpose: preventing you from stopping long enough to verify the request.

The Federal Trade Commission warns that unexpected demands requiring payment by gift card, cryptocurrency, wire transfer, bank transfer, or payment app are strong indicators of a scam.

Prepare Before an Urgent Request Arrives

Verification is easier when trusted contact information is already available.

Prepare:

• Official telephone numbers saved in your contacts
• The numbers printed on bank and credit-card statements
• Trusted bookmarks for financial and important accounts
• Official applications installed from the correct app store
• A password manager
• A family emergency contact plan
• A private family verification word or phrase
• Written approval procedures for business financial requests

Being prepared reduces the temptation to rely on contact information supplied by the person creating the emergency.

Use the Pause-and-Verify Method

1. Do Not Argue or Investigate With the Caller

You do not need to prove that the person is a scammer before ending the conversation.

Say:

“I don’t conduct account business through incoming calls. I’ll contact the organization directly.”

A legitimate representative should understand that you want to verify the request independently. If the caller becomes angry, increases the pressure, or insists that you remain connected, that gives you another reason to stop.

2. End the Original Contact Completely

Hang up, close the message, or end the chat.

Do not use:

• The caller’s callback number
• A telephone number in the message
• A link supplied in the email or text
• A website opened by the caller
• A sponsored search result
• A transfer to the caller’s supposed supervisor
• Another department reached through the same call

A scammer’s colleague can easily pretend to represent a fraud department, supervisor, bank, government agency, or technical-support team.

Ending the original contact breaks the scammer’s control over the conversation.

3. Find an Independent Contact Method

Contact the person or organization using information you already trust.

Good sources include:

• The number printed on the back of your bank card
• A telephone number on a recent paper statement
• An official application you previously installed
• A trusted bookmark you created earlier
• A known website address typed manually
• A family member’s number already stored in your contacts
• Your company directory or established approval system

Avoid relying on the first search result. Scammers sometimes purchase sponsored advertisements that display fraudulent customer-service numbers.

If the request supposedly came from a family member, call that person directly. If you cannot reach them, contact another relative who would know what is happening.

4. Explain What Happened

Tell the independently verified representative:

• The number or address that contacted you
• What the person claimed
• What they asked you to do
• Whether you clicked a link or opened an attachment
• What information you disclosed
• Whether you sent money
• Whether you installed software
• Whether you provided a verification code

Ask the representative to review the account through the organization’s normal procedures.

5. Preserve Useful Evidence

Before deleting the message, save relevant evidence:

• Screenshots
• Date and time
• Caller’s number or email address
• Website address
• Payment instructions
• Transaction confirmation
• Claimed name and department
• Email headers, when available

Do not continue communicating merely to collect more evidence. Preserve what you already have and end the contact.

Protect Your Verification Codes

A one-time verification code is not a customer-service identification number. It is a temporary credential used to sign in, approve an action, or reset an account.

Never read or forward a verification code to someone who contacted you.

An unexpected code may mean someone entered your username, attempted to reset your password, or tried to authorize a transaction. It may also result from an innocent typing mistake, so it is not proof by itself that the account has been compromised.

When you receive an unexpected code:

1. Do not share it.
2. Open the official application or website directly.
3. Review recent account and sign-in activity.
4. Change the password if the activity is suspicious.
5. Sign out unfamiliar sessions when that option is available.
6. Confirm that multifactor authentication and recovery information are correct.

Never approve an authentication prompt that you did not initiate.

When the Request Appears to Come From Someone You Know

Email, social-media, and messaging accounts can be compromised. Names, profile pictures, writing styles, and voices can also be imitated.

Verify through a different channel:

• If the request came by email, call the person at a known number.
• If it came by text, use an established work number or another trusted method.
• Confirm workplace financial requests verbally through established approval procedures.
• Require a second person to approve significant changes in payment instructions.
• For a family emergency, use a prearranged verification phrase.

Do not rely solely on recognizing a voice. The FBI has warned that criminals use AI-generated audio to impersonate officials and personal contacts.

A family verification phrase should be memorable but not posted online or easily guessed from birthdays, pets, schools, or social-media profiles.

Business Requests Require the Same Caution

Small businesses are frequently targeted with messages that appear to come from an owner, manager, vendor, financial institution, or employee.

Before changing bank details, purchasing gift cards, sending payroll information, or making an unusual payment:

• Confirm the request verbally
• Use a previously known telephone number
• Follow written approval procedures
• Require additional approval for unusual or high-value payments
• Treat last-minute changes in payment instructions as suspicious
• Do not bypass normal procedures because a message appears to come from management

A legitimate business process should allow enough time for independent verification.

If You Already Responded

Act promptly, but continue using trusted contact information.

If you sent money

1. Contact the bank, card issuer, payment application, wire service, gift-card issuer, or cryptocurrency provider immediately.
2. Report that the transaction resulted from a scam.
3. Ask whether the payment can be stopped, reversed, recalled, or refunded.
4. Preserve receipts and transaction details.

Recovery is not guaranteed, but acting quickly may improve the available options.

If you shared a password or verification code

1. Use a trusted device to change the affected password.
2. Change any other account using the same or a similar password.
3. Begin with your primary email account because it can reset other accounts.
4. Sign out other sessions.
5. Review recovery email addresses and telephone numbers.
6. Enable or reset multifactor authentication.
7. Contact the service’s fraud or account-recovery department.

If you installed remote-access software

1. End the contact.
2. Disconnect the affected computer from the internet.
3. Do not use it for banking, email, or password changes.
4. Use a separate trusted device to protect affected accounts.
5. Contact a trusted IT professional to inspect the computer.
6. Notify financial institutions if financial information was visible or entered.

If you shared personal information

Visit IdentityTheft.gov for a recovery plan appropriate to the information involved.

Report attempted or completed scams at ReportFraud.ftc.gov.

Common Mistakes

Avoid these common mistakes:

• Trusting caller ID
• Treating a familiar logo as proof
• Calling the number supplied in the message
• Clicking a login link to “check” whether the warning is real
• Using the first sponsored search result
• Remaining on the phone while moving money
• Giving someone a verification code
• Installing remote-access software for an unexpected caller
• Keeping the situation secret
• Relying only on voice recognition
• Skipping normal business approval procedures
• Continuing the conversation to gather evidence
• Feeling embarrassed and delaying a report

Scammers succeed by creating pressure and confusion. Ending the contact is not rude. It is a reasonable security precaution.

Today’s Practical Step

Save the official telephone numbers for your bank, credit-card companies, important service providers, and regular IT support.

Then create a family verification word or phrase and agree that unexpected financial or emergency requests will always be confirmed through a separate channel.

If you receive a suspicious technology warning, remote-access request, or urgent account message, Lofgren IT Consulting provides practical assistance for homeowners and small businesses throughout Prescott, Prescott Valley, Chino Valley, Paulden, and surrounding Arizona communities.

Read more about fake tech-support scams, learn about a security review, or contact Lofgren IT Consulting for help evaluating what happened and determining the appropriate next steps.