A familiar name, profile photo, phone number, voice or account can still be fake or compromised. When a person you know or an organisation you trust makes an unusual request, leave the requesting channel and confirm both the person's identity and the specific request through a separate trusted channel.
If the message says, "Call this number to confirm," calling that number is not independent verification. If a caller says, "Read the code back so I know it is you," the caller is controlling the verification conversation.
Independent verification means moving outside the channel that created the request and using contact information or a trusted route you already had, or one you find independently.
The objective is not to distrust everyone. It is to prevent someone from borrowing a trusted identity to make you act.
Start by identifying who the person claims to be and what makes the identity look familiar.
An identity claim becomes more important when it is attached to a consequential request.
The channel that created the request should not be the only channel you use to verify it.
Use a source that the suspected impersonator does not control.
Even a genuine person's account can be compromised, so identity alone is not enough.
Urgency does not prove fraud, but it should increase your care.
If you cannot independently verify both the person and the request, pause.
In each example, the safest move is to separate the verification from the channel that created the request.
A WhatsApp message says: 'It is me. I lost my phone. Please send me ₦80,000 urgently.' The profile photograph looks correct and the person mentions a recent family event. Do not use the new number to verify itself. Call the old number if available, contact another family member through a previously trusted channel, or use another established way to confirm the request before sending money.
A friend's existing account suddenly asks for a transfer, gift card, cryptocurrency or another form of value. The account may genuinely belong to your friend, but it could also be compromised. Contact your friend through a separate channel you already trust and confirm the exact request before acting.
A caller says there is a problem with your account and asks for the OTP just sent to your phone. Do not read the code to the caller. End the call and contact the bank using the official app, website or a phone number you already trust. The OTP helps authenticate an account action; it does not prove that the caller is a bank employee.
A social-media account claims to be customer support and asks for your password or recovery code to fix an account problem. Do not provide the secret. Open the service yourself and use its official support or account-security process. Verify the organisation independently instead of relying on the account that contacted you.
A message appears to come from a relative who says they are stranded and cannot answer a call. They demand immediate payment and ask you not to tell anyone. Treat the urgency as a reason to verify, not a reason to skip verification. Contact the relative using a number you already had or reach another trusted family member.
A message from a manager appears to request an urgent payment or purchase. The name and profile picture are correct. Do not approve a consequential business action from the message alone. Use an established workplace channel, known phone number or existing approval process to confirm the request.
A familiar supplier sends a message saying future payments must go to a new account. Do not verify the change by replying to that same message. Call the supplier using contact information already stored in your records and confirm the new payment details before changing the beneficiary.
Someone claims to be a relative and knows your workplace, hometown, family member's name or recent activity. Those details can make the conversation convincing, but they are not proof of identity. Ask how the request can be independently verified and use a trusted channel that existed before the contact.
These requests deserve independent verification before you act.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
Do not rely on the identity presented in the requesting conversation alone. Verify through an appropriate independent channel first.
1. WHO? Who does this person claim to be?
2. WHAT? What exactly are they asking me to do?
3. SEPARATE? Have I left the channel that made the request?
4. CONFIRM? Did I independently confirm both the person and the specific request?
5. CONSEQUENCE? What happens if I am wrong?
If a consequential request cannot pass this test, pause before acting.
If you sent money, contact your bank or payment provider through its official channel. If you shared an OTP, password or recovery information, secure the affected account through its official security process. If sensitive information was shared, document what happened and consider which accounts or services could be affected.
Preserve relevant messages, numbers, usernames, URLs, transaction references and timestamps before deleting evidence unnecessarily.
A familiar identity can be copied. A familiar account can be compromised. A familiar voice can be imitated. When the request matters, separate the verification from the request.
PAUSE → IDENTIFY → SEPARATE → VERIFY → CONFIRM → ACT
VERIFY BEFORE YOU TRUST.