Five Minutes: Verify a Request Through a Separate Channel

Learning objective

Choose an independent verification route before acting on an unexpected request.

Your five-minute route

Allow about one minute for the idea, one minute for the worked example, two minutes for your own answer and one minute for feedback. Work at your own pace. These timings are estimates. Use a notebook or a document for your response; no answer is submitted and no account progress is recorded.

One useful idea

The NCSC advises stopping suspicious contact and contacting the organisation directly. Use details you already trust or obtain independently. A reply to the same message, or a call to the number it supplies, may return you to the same sender. Familiar names and urgent wording do not verify a request.

Worked example

In a fictional exercise, an email appears to come from a supplier and asks for an urgent bank-detail change. Instead of using its attached contact sheet, the finance administrator follows the established supplier-verification process and uses a previously verified contact route. The administrator confirms the request before any payment change is considered. Verification does not replace the organisation’s approval controls.

Check your learning

A fictional manager message asks you to buy vouchers immediately and supplies a mobile number “for confirmation”. Choose the strongest response: A, reply asking whether it is genuine; B, call the supplied number; C, pause and contact the manager through the already known internal directory route. Explain your choice. Write your answer before reading the explanation below.

Answer and explanation

C is the strongest response because the route is independent of the unexpected message. A and B rely on details controlled by the sender and do not resolve the concern. Do not buy the vouchers or share sensitive information while authenticity remains unconfirmed. Report the message through your organisation’s established process. If you have already acted, raise it promptly with the responsible team rather than concealing the mistake.

Use it in your work

Identify your approved reporting route and where you can find trusted contact details. Keep this as a planning exercise; do not send test scam messages to colleagues without authorisation. For personal suspicious messages, use the current official reporting guidance.

Completion check

You have completed this unit when you can explain the idea in your own words, compare your answer with the explanation and apply the same approach to one new example. If your answer missed a key point, revise it and try again. This is a practice lesson, not an examination or a validated assessment.

Sources and provenance

Further reading: NCSC: How to spot a scam email, text message or call and GOV.UK: Report internet scams and phishing. The scenarios and answer explanations are original RDE teaching examples. Names, organisations and records used in examples are fictional. Reviewed 8 October 2026. Author: Jefferson Otonbara Imgbi.

Cover image: AI-generated illustrative scene created specifically for this resource.