The principle is channel independence. If a request arrives by email, confirmation by reply email is worthless, because an attacker inside the mailbox controls both sides. A telephone call to a stored number, a message in a supplier portal the buyer authenticated into, or a signed confirmation through a separate system all qualify.
The failure mode is a channel that appears separate but shares the same compromised identity, such as a chat tool that authenticates through the same directory as the mailbox.
Common questions
Is a reply email out of band verification?
No. A reply travels the same channel as the request, so a compromised mailbox can answer it.
What counts as a truly separate channel?
One that does not depend on the same credentials or identity provider as the original channel, such as a phone call to a previously stored number.
Primary sources
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/out-of-band-verification.