Exercise 2: "Can't Verify Right Now" vs. "Won't Verify At All" — Possible Solution ==================================================================== WHAT THIS CHAPTER SAYS ------------------------------ Per this chapter's finding-box, "'can't verify right now' and 'won't verify at all' are different problems with different answers. This procedure is built to solve the first without ever accepting the second." WHY THEY LOOK IDENTICAL AT FIRST ------------------------------ Both situations present the same way in the moment: a requester saying they're unable to complete verification right now. On the surface, refusing to offer any path forward would treat both identically - which is exactly why the chapter insists on separating them rather than picking one blanket response. WHY THE SELF-SERVICE PATH IS THE TEST THAT TELLS THEM APART ------------------------------ A genuinely legitimate requester who "can't verify by phone right now" almost always still has some verification path available - a self-service reset tied to a device they already have, or a manager they can reach directly. Offering that path costs them almost nothing if they're real: it takes under a minute, per the chapter. A requester who has no genuine access to the account - because they're not who they claim to be - can't use that path either, since it depends on something only the real owner possesses. WHAT HAPPENS TO EACH TYPE OF REQUESTER WHEN OFFERED IT ------------------------------ The legitimate case: the requester takes the offered path and the situation resolves in under a minute, confirming they genuinely "couldn't verify by phone right now" but could verify some other way. The illegitimate case: per the chapter, "a request that suddenly goes quiet once a real verification path is offered has told you everything you need to know" - the inability to use *any* verification path reveals that the original excuse wasn't really about the phone at all, it was about avoiding verification altogether. WHY THIS WORKS AS AN ANSWER ------------------------------ It states the chapter's own distinction, explains why the two situations look identical without a test to separate them, and explains specifically why offering a self-service alternative works as that test - a genuine requester can use it, while someone avoiding verification entirely cannot.