Verify a caller's identity: useful questions and a grid

To verify a caller's identity, no question asked during the call proves on its own who they are. The only solid check is to step out of the call and reach the person through a channel you control. Questions serve to buy time, take notes and spot a script, not to validate an identity.

Here are the questions worth asking, those that prove nothing, and the exact sentences to phrase them. This article is part of our series on security awareness training and vishing.

Why a security question is not enough

Classic procedures ask for a date of birth, an address or a customer number. Sometimes the last movement on an account. This information has a flaw: it is not secret. It circulates in data leaks, on social networks, in professional directories or in documents already stolen.

A fraudster who calls often knows more than you imagine. They have prepared their call. According to the 2025 activity report of the French agency Cybermalveillance.gouv.fr, fake bank advisor fraud rose by 159%. This shows that such calls are numerous and well rehearsed.

There is a second difficulty, a psychological one. When the caller answers three questions correctly, trust sets in. It also sets in when they hesitate and then apologize politely. You then check less of what they ask next.

The questions that prove nothing

These questions can stay in a procedure, but you should know they guarantee nothing.

• Date of birth, address, employer. Public or leaked information.
• Name of the advisor, manager or branch. Visible on a website, a professional profile or an email signature.
• Last transaction, last purchase. Available after a data theft or a first contact.
• Number displayed on the screen. It can be spoofed. The same 2025 Cybermalveillance.gouv.fr report records a 517% rise in phone number spoofing.
• A code received by text message that you are asked to read out. This is the opposite of a check: you give the caller what they need to approve a payment.

A good answer from the caller to these questions is simply a sign that they have documentation. So never conclude “that’s fine” after a series of right answers.

The questions that really help

Three types of questions are useful, even though none validates anything alone. They take the caller off their script and leave a trace.

Framing questions

They serve to take notes and slow things down.

“Could you give me your name, your department and a callback number again? I’m noting them down.”

“What exactly is the purpose of your call?”

Questions that break the script

An attacker prepares a path. A simple question off the path puts them in difficulty.

“Why are you calling rather than writing through the usual messaging?”

“Who have you already spoken to about this file in the company?”

A genuine counterpart answers easily and understands that you are checking. A fake one dodges, gets irritated or repeats their request, often in the same words.

Questions about the procedure

“What is the official procedure for this request?”

“Can you send me the request through internal messaging, so I can have it approved by my manager?”

If the caller refuses the written or official route, that is a signal. A legitimate department agrees to leave a trace.

The check that proves: stepping out of the call

The only reliable way to confirm an identity is to stop depending on the caller. You hang up and reach the person or department through a number, a mailbox or an app that you already have.

“I can’t process this request by phone. I’ll call you back on the official number.”

This habit is detailed in our article on the callback procedure through an independent channel. It is also the defense against voice cloning, covered in the article on AI voice cloning.

For high-stakes circuits, a second device exists: the agreed word. It is decided in advance between two people, kept secret and renewed. It is never requested in reply to a caller unless it was defined beforehand.

How to ask these questions without causing offense

The fear of seeming distrustful stops many employees from checking. The remedy is a wording that presents the check as a general rule, not as suspicion.

• “It’s the procedure for everyone, including management.”
• “Thank you for understanding, we have a systematic callback rule.”
• “If it really is you, it will only take two minutes.”

That last sentence is particularly effective. It does not cast doubt on the person; it points out that the check costs little for an honest counterpart.

Adapting the check to the announced caller

The approach varies a little depending on the role the caller claims. The principle stays the same: do not rely on what they say.

A fake advisor or a fake bank security department

No bank needs you to approve a transaction while it is talking to you. That request alone should end the call. You contact your bank through the number on your card or through your app.

A fake supplier or a fake executive

A change of banking details or an urgent wire transfer is confirmed with a known contact, on a number already on file. Our article on CEO fraud describes the dual approval that completes this check.

A fake IT support

A call that asks for a password, an authentication code or the installation of software is not handled by phone. Real support never asks for these things aloud. It goes through a ticket or an internal tool.

A fake colleague

A real colleague accepts that you call them back on their line or write to them on internal messaging. A refusal from them is unusual and deserves a report.

A reusable verification grid

Here is a simple grid to keep close at hand, to print or to build into the internal procedure.

1. I note: name, department, number given, time, purpose of the call.
2. I spot: urgency, authority, secrecy, request for a code, refusal of a callback.
3. I give nothing: no code, no password, no approval of an operation.
4. I step out of the call: I hang up and call back through a known channel.
5. I report: to the security team, even with no damage.

The levers to spot in step 2 are described in our article on social engineering levers. For step 5, the grid in our article on reporting a security incident shows what to retain.

Common mistakes

• Asking questions the caller has prepared for. A question about public data brings nothing.
• Accepting a callback number given by the caller. It leads to them, not to the announced department.
• Checking, then giving in. Even after a partial check, a request for a code or a wire transfer is still to be refused.
• Apologizing for checking. An apologetic tone invites negotiation.
• Winging it. Without a ready sentence, politeness wins.

Why spoken practice changes the outcome

Knowing these questions is easy. Asking them, in a steady voice, to a counterpart who insists, is much harder. Nerves, the wish to be pleasant and the fear of getting it wrong take the place of reasoning.

Practicing a role-play puts the learner back in that situation. With Face Up, the trainer creates a scenario. A persona played by an AI presents itself as a supplier or an advisor and reacts to the learner's questions. At the end of the session, the debrief shows whether the checks were asked, whether a code was given, and quotes the sentences spoken. The learner can play again until the right wording becomes automatic.

Frequently asked questions

What is the best question to verify a caller?

There is no single one. The most useful is the one that opens the exit: “I’ll call you back on the official number.” It depends on no information the fraudster might know.

Can you trust the number displayed?

No. Number spoofing makes it possible to display the number of a real bank or a real department. The 2025 Cybermalveillance.gouv.fr report points to a sharp rise in this technique.

What if the caller knows my personal information?

That does not prove their identity. Personal data circulates after leaks or online searches. Apply the same procedure: hang up, call back, report.

To train your teams to ask these questions aloud, discover Face Up role-plays or book a demo.