A verification callback is a separate, trusted contact method used to confirm whether a request is genuine. Instead of replying through the channel that delivered the request, the recipient independently contacts a known phone number, email address, or internal help desk to validate it. This breaks the attacker’s control over the conversation and helps detect impersonation.
It matters because many scams rely on urgency and authority. In police-impersonation fraud, for example, a caller may demand immediate action and try to keep the target from checking with a real office. A verification callback defeats that tactic by slowing the decision and using an out-of-band channel. Security teams use it for payment changes, account resets, access approvals, and any request that feels unusual, high-risk, or time-sensitive.