When can a callback contribute to verification?
Use a contact destination obtained through the approved independent source, and check how that record can be changed. A completed call establishes reachability; the recovery procedure still determines which checks authorize the requested account change.
A support agent ends an incoming call and calls the employee back. The recovery checklist now says “callback completed.” Before treating that as identity verification, ask where the callback number came from.
If the agent used a number supplied during the unverified conversation, the second call has not provided an independent contact path for out-of-band verification. The same requester selected both ends of the interaction. The caller verification guide explains when to hold a recovery request. This review goes one step earlier: who established the contact record the agent is about to trust?
Mandiant recommends additional verification for high-risk service-desk changes, including callbacks to registered numbers or confirmation through known corporate channels. Its June 2025 vishing analysis describes actors impersonating employees to obtain credential and MFA-method resets. Mandiant: service-desk identity verification
Trace the number before placing the call
Choose the approved contact source before calling. Once someone answers, complete the checks required by your recovery procedure before replacing an authenticator. Reaching the number is only one step.
For a high-risk recovery, record the contact source alongside the callback result. Useful descriptions include “existing employee directory record” or “approved recovery contact record.” Avoid putting the number itself into a broadly shared training report when a restricted reference will do.
Ask whether the contact record changed during the same request. If the requester supplied a replacement number because their usual phone was unavailable, route the situation through the established exception process. Do not use the new number to approve its own addition.
Check the callback source
- Check contact provenance
How was the record obtained and changed? Is it an approved independent source?
- Yes
Call back using that source. Complete verification and authorize only the permitted change.
- No or unsure
Keep the change pending. Use the designated exception owner or approved recovery route.
Reaching a number alone does not verify identity or authorize a reset.
When the registered contact is unavailable
An unavailable recovery contact is an exception to resolve before the account change. If you let the caller supply a new number and then call it, you are relying on the person you still need to verify.
The agent should leave the ticket pending and involve the designated recovery owner under the approved alternative-verification procedure. Evaluate that decision against the recovery requirements, rather than ticket-closure speed.
Check who can change the trusted record
Trace one approved recovery contact from its creation to its use. Identify the system that owns the record, who may edit it, what authorizes an edit, and whether the support tool shows the change history. If another system copies the record, include that synchronization in the review. An entry can look established in the support tool while its source was changed minutes earlier.
Even a number retrieved from an approved system may have been updated during the unresolved recovery request. Ask the record owner what authorized that update. An approved system can contain an unverified value if its change process accepts the same disputed request.
Give frontline agents an escalation rule and a named owner for disputed contact changes. The process owner should decide which contact changes require scrutiny and make that requirement workable in the support interface.
Make the next agent’s decision easier
A ticket should identify the approved contact source, the authority behind its latest relevant change, the callback result, and the owner who authorized the account action. A single “verified” checkbox hides those decisions.
A note such as “Approved recovery contact unavailable; no method change performed; exception assigned to recovery owner” lets another agent continue the case without repeating an unsafe shortcut.
Make the approved contact easy to find
The process owner should look for a hard-to-find contact record, an unclear exception owner, or a checklist that treats any callback as sufficient. The tabletop guide describes one way to test a revised procedure without changing production credentials.
