The principle is channel independence. If a request arrives by email, confirmation by reply email is worthless, because an attacker inside the mailbox controls both sides. A telephone call to a stored number, a message in a supplier portal the buyer authenticated into, or a signed confirmation through a separate system all qualify.
The failure mode is a channel that appears separate but shares the same compromised identity, such as a chat tool that authenticates through the same directory as the mailbox.
Independence is easy to lose without noticing. The number is taken from the signature block of the request rather than the vendor record. The portal login is reset through the same mailbox. The confirming contact was introduced by the person making the request. In each case the second channel is downstream of the first, so it can only agree with it.
Treat generative voice and video as a reason to verify facts rather than voices. A confirmation is stronger when it turns on something the counterparty holds and an impersonator does not, such as a reference stored in the vendor record or an account detail the payee proves through their own bank, rather than on whether the caller sounded right.
Common questions
No. A reply travels the same channel as the request, so a compromised mailbox can answer it.
One that does not depend on the same credentials or identity provider as the original channel, such as a phone call to a previously stored number.
Only when the number came from your own records rather than from the request, and when the number itself is protected against porting or device takeover.
It holds up when the confirmation depends on information the counterparty holds, such as a stored reference or a validated account, rather than on recognising the speaker.
Sources and further reading
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/out-of-band-verification.