A supplier asks to change where you pay. Compare a same-thread email reply with a callback. Neither proves account ownership.
Comparison
| Question | Email check | Callback check |
|---|---|---|
| Leaves a written record | Yes, the thread | Only if the caller writes a note |
| Separate from the request | No, if you reply on the same thread | A second communication type, regardless of storage. A suitable route separately needs provenance and current trust; no proof of identity |
| Speed | Can be quick | Depends on reaching a person |
| If the trusted contact cannot be reached | A same-thread reply does not resolve this. The inability to reach a trusted contact remains | The gap is recorded and the hold stays |
| Proves account ownership | No | No |
Reading the table
An email reply on the same thread is not a separate channel. A person who wrote the first message can answer the follow-up. The NCSC phishing guidance recommends confirming important email requests through a second channel, such as a phone call, and helping staff know the usual payment process so odd requests stand out.
A callback helps only when the route was stored before the request. A number printed in the suspicious email does not qualify. Use a contact reference stored before the request, such as a supplier master entry, a contract or an earlier payment record. The human reads the number from protected records; AI never receives it.
Even a stored route may be stale or compromised. A call through it is a separate channel. It does not prove who answered or that the route is still trusted. Record what the person who answered reported. Do not record that the supplier recognized the request. The responsible human checks current route trust under local policy. If that stays unresolved, the hold stays.
When the callback cannot be completed
If nobody answers, the contact has left or the stored route looks out of date, the hold stays. Do not fall back to the number in the new email. Do not pay the new destination because time is short. Tell the responsible approver and record the gap.
What each method cannot do
- A same-thread email gives a record, not a separate channel. An off-thread email is still email, not a second communication type.
- A callback gives a separate channel but needs a written note to become a record.
- Neither shows that a bank account belongs to the supplier. Ask the approver whether local policy needs more evidence.
Suggested combination (practice suggestion)
- Do not reply on the request thread.
- Call the stored route and write the note at once, as a reported statement.
- Send a short written confirmation to the address already on file, not on the request thread.
- Keep the hold until a separate authorized person decides.
Source support
NCSC supports second-type confirmation. CC8 (4.2, 6.4) covers own-credential protection and recall difficulty, not supplier authentication. Charity decision-record guidance and CC8 apply to England/Wales charities. The combination is our suggestion.
Fictional example
Supplier S-14, invoice INV-28 (USD480, due November 6): the November 1 email gave a new phone number. Reference VC-07 was stored earlier. No callback has happened, so the destination is unverified, the supplier master is unchanged and payment is held.