Exercise 3: Why Calling Back at a Known Number Is Genuinely Different Verification — Possible Solution ==================================================================== THE TWO OPTIONS COMPARED ------------------------------ Option one: trust the phone number the caller is calling from, or a callback number they themselves provide. Option two: independently look up Facilities' own known internal number and call that instead. Per this chapter's tip-box, "if you can't verify a claim through a channel the caller themselves doesn't control ... you can't verify it at all." WHY OPTION ONE VERIFIES NOTHING ------------------------------ Any number the caller supplies - whether it's what shows on caller ID or a number they read out - is entirely within their own control. Caller ID is trivially spoofable (established already in Chapter 2's vishing material), and a callback number they provide themselves could simply ring back to the attacker, or an accomplice, no matter how official it sounds. "Verifying" through a channel the claimant controls just confirms that the claimant can answer their own phone - it proves nothing about who they actually are. WHY OPTION TWO ACTUALLY VERIFIES SOMETHING ------------------------------ A number looked up independently - from an internal directory, a company intranet, or a previously known contact - was not supplied by the caller and isn't something they can redirect. If the person who answers that independently-sourced number confirms the request, the confirmation is coming from a source the caller had no ability to manipulate. WHY THE CHAPTER FRAMES THIS AS THE ONLY WAY TO VERIFY AT ALL ------------------------------ Any check that still routes back through information the claimant themselves supplied isn't really an independent check - it's just asking the same source to confirm itself. The value of verification comes specifically from using a path the untrusted party has no control over; without that, there is no genuine verification, only the appearance of one. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains specifically why a caller-supplied number proves nothing (it's within the claimant's own control), explains why an independently-sourced number does verify something (it's outside their control), and connects this back to the chapter's own explicit statement that only a channel the claimant doesn't control counts as real verification.