Callback procedure: the rule that stops vishing

The callback procedure consists of hanging up, then calling the other person back on a number you found yourself. Never the one they give you or the one that appears on screen. It is the rule that breaks most vishing attempts, because the attacker no longer controls the channel. For it to work, it has to become a reflex, phrased without causing offense.

Here is the method step by step, the phrases to say, the mistakes to avoid and how to make it automatic. This article is part of our guide to cybersecurity awareness and vishing.

Why the callback is the most effective rule

An attacker who phones controls the conversation: the pace, the script, the number displayed. They count on you staying inside their frame. The callback moves the exchange to a channel they do not control.

The technical reason is simple. The number that appears can be spoofed. According to the 2025 activity report of Cybermalveillance.gouv.fr, the French national cyber-victim assistance service, phone number spoofing rose by 517%, despite the regulatory and technical measures in place. The displayed number is therefore no proof.

The psychological reason matters just as much. Hanging up interrupts the pressure. Urgency loses its force, calm returns, and the decision is taken in better conditions. It is an antidote to the levers described in our article on social engineering.

The method in five steps

1. Promise nothing during the call. Do not confirm, do not give a code, do not approve any transaction.
2. Announce the callback. “I'll call you back in a few minutes.”
3. Hang up. Without waiting for the caller to finish their pitch.
4. Find the number yourself. Internal directory, official website typed in by hand, bank card, letter or official app.
5. Call back and report. Ask the person or department whether the call came from them, then report it.

The detail of step 5 is in our checklist for reporting a security incident.

Which number to use for the callback

Everything depends on this: the rule is only worth something if the callback number is independent of the call.

• Good choice: the number from the internal directory, from the contract, from the bank card, from the latest statement or from the official app.
• Good choice: an internal messaging tool or a message to the person via a channel already in use.
• Bad choice: the number given by the caller “to reach me directly”.
• Bad choice: the phone's “call back” button, which may lead to a spoofed number.
• Bad choice: a number found in an email or text received during the call.

Cybermalveillance.gouv.fr also advises against calling back a premium-rate or foreign number left as a missed call with no message. The callback applies to numbers you have verified, not to just any number.

How to say it without causing offense

The difficulty is not technical. It is social: people fear upsetting a client, a superior or a colleague. The solution lies in a formula that presents the callback as a general rule.

“I always call back on the official number before any transaction, it's our rule for everyone.”

“If it really is you, we'll speak again in two minutes.”

“I'm not asking you to prove anything, I'm simply following the procedure.”

Faced with a caller who insists, you repeat the same sentence without lengthening it. Our article on saying no on the phone under pressure develops this point.

An honest contact understands and accepts the callback. A fraudster reacts differently. They get annoyed, threaten, make you feel guilty or claim that a callback is impossible. That reaction is useful information.

Two typical scenarios

Imagine a call to the accounting department. A caller introduces themselves as the CEO and demands an urgent wire transfer to a new supplier. The accountant replies: “I'll call you back on your internal line in five minutes.” They call the real CEO, who knows nothing about the request.

Imagine another call, to a private customer. A fake bank advisor announces a suspicious transaction and asks them to approve it in the app. The customer hangs up, opens the official app or dials the number on their card, and checks. Our article on the fake bank advisor method details this mechanism.

Common mistakes

• Calling back on the displayed number. It may be spoofed.
• Staying on the line “to check together”. That is the attacker's frame.
• Announcing the callback but giving in before it. “Just one code, and I'll call you back” ruins the rule.
• Making no exception for executives. The rule applies to them too.
• Not reporting after a conclusive callback. The fraudulent call may have targeted other colleagues.

Cases where the callback needs a little adaptation

The rule sometimes runs into practical situations. Planning for them stops employees from working around it.

• A contact who cannot be reached. Provide a second contact: a deputy, a switchboard, an internal messaging tool. As long as nobody has confirmed, the request stays on hold.
• A call outside working hours. An urgent request at night is confirmed in the morning, or through an on-call channel already identified. A genuine matter can bear a few hours' delay.
• A customer calling in good faith. The callback is presented as a safeguard for them. “I'll call you back on the number in your file, for your security.”
• A call on a video conference. The principle is the same: you leave the meeting and contact the person through another channel, such as internal messaging.

In all these cases, what matters is that the rule is known in advance, without having to reinvent it during the call.

Making the callback automatic

A rule that is known is not a rule that is applied. Three organizational levers help turn it into a reflex.

• A trusted number within reach. An up-to-date directory, numbers for sensitive processes displayed, an approved list of bank contacts.
• Backing from management. The executive announces that their own requests will be called back, which removes any awkwardness.
• Ready-made phrases. A card with three wordings avoids making things up under pressure.

These measures set the framework. One last step remains: saying the sentence, out loud, on the day itself.

Checking that the rule is really applied

A callback procedure is not assessed by the number of people who have read it. It is assessed by what happens when an unusual call arrives. A few markers show this.

• The number of reports. An employee who hung up and sounded the alarm is applying the rule, even if the call was legitimate.
• The quality of the report. Are the name given, the time, the request and the lever used noted?
• The callback delay. It stays short, which shows the rule does not slow work down.
• Feedback from teams. Where does the rule get in the way? Which phrase are they missing?

These findings feed the regular review of the procedure. They also make it possible to show, in the event of an audit, that the practice is followed and not merely declared. The callback is worked on like any professional skill: in short cycles, with feedback after each attempt.

Practicing so the action comes naturally

Reading a rule is not enough to hold to it in front of someone shouting at you. The action is built through repetition, in conditions close to reality.

With Face Up, the trainer writes a scenario from situations experienced in their organization. A persona played by an AI takes the role of the pressing caller, and the learner has to refuse and announce the callback out loud. The debrief quotes what they said, shows whether they gave out any information before hanging up and offers an action plan. The learner can then play again.

Frequently asked questions

Is the callback useful if the caller really is who they claim to be?

Yes, it only costs a few minutes. A legitimate contact understands the rule. It also protects the person being called back, whose identity may have been spoofed.

Do I have to call back immediately?

Not necessarily, but quickly enough to deal with the request if it is genuine. Leaving a few minutes allows you to find the right number and consult a colleague.

What should I do if the real department does not answer?

Do not give in to the request for lack of an answer. Try another route, such as internal messaging or a manager, and give nothing until verification has succeeded. The useful questions during the call are in our article on verifying a caller's identity.

To train your teams to announce the callback without hesitating, discover Face Up role plays or book a demo.