How to verify someone's identity online before you trust them

Almost every scam on this site rests on the same unexamined assumption: that the person contacting you is who they say they are. Verification is the single habit that interrupts all of them, and it is much simpler than it sounds.

Quick answer

Verify through a channel the other person did not supply.

Hang up, look up the organisation's number yourself, and call that. Message the person on the account you already had. Walk into the branch. Ask someone else who would know.

That is the whole method. It works because your contact controls everything they send you — the number displayed, the address on the email, the photo of the badge — and controls nothing about a route you find independently.

Everything below is how to apply it in specific situations, and what to do when the other person makes it awkward.

What is not proof

Getting this list right matters more than learning any technique, because each item below is routinely mistaken for evidence.

The method

For an organisation that contacted you

1. End the contact. No explanation needed. Hang up, close the chat, do not reply to the email.
2. Find the real contact details yourself. From the back of your card, a statement you already had, the official app, or the website typed into the address bar. Not from the message, not from a search advert.
3. Call and ask. "Someone contacted me claiming to be from you about X. Can you confirm whether that is genuine?" Give them the reference if you have one.
4. Wait for a clear answer. If they cannot find any record of it, that is your answer.

For a person who contacted you

1. Reach them through a route you already had. The number in your contacts, the account you have messaged for years.
2. If that fails, ask someone who would know — a colleague, a relative, their workplace.
3. Use a pre-agreed code word if your family has one. If you do not have one, set one up.
4. Ask something a stranger could not know, and that is not on social media. Not "what is my dog's name" — something from a shared experience.

For someone you have only met online

1. Reverse image search their photos. Stolen images often appear under other names.
2. Look for history that includes other people — tagged photos, comments from the same friends over years.
3. Ask for a spontaneous video call. Not scheduled. Excuses about cameras, bandwidth or work are meaningful.
4. Watch what is eventually asked for. This is the decisive test, and it requires no detective work at all.

Fake profiles and social media scams covers this case in detail.

For a company you are about to pay

1. Search for it independently, rather than following a link.
2. Check the public register relevant to its industry and country — financial regulators, company registries, professional bodies.
3. Check the domain carefully. Lookalike domains are the standard trick; how to check if a link is safe explains how to read one.
4. Look for a real address and phone number, and try the phone number.
5. Check the payment method. A legitimate business does not require gift cards, cryptocurrency, or a wire transfer to a personal name.
6. Search the name with the word "scam" or "review". Not conclusive either way, but occasionally decisive.

Match the effort to the stakes

Verifying everything would be exhausting and nobody does it. Scale the check:

The rule of thumb: the more urgent the request feels, the more verification it deserves. Urgency is manufactured precisely to prevent this step. Urgency manipulation explains the mechanism.

When they make it difficult

Every objection you will hear is a variation on preventing verification.

Verifying yourself to other people

Worth a moment, because it is the other half of the habit. If you are the one asking a family member for money or a colleague for access, expect to be verified and make it easy:

• Agree a family code word and use it without complaint.
• Confirm through a second channel when you change payment details — call and read the account number aloud.
• Do not ask for anything unusual by message alone.
• Tell older relatives you will never mind being checked. That single sentence removes the embarrassment that stops people verifying.

If you did not verify, and now you are worried

Not a disaster on its own. What matters is what was handed over:

• Money — contact the payment provider immediately; speed is the main variable.
• A password — change it and sign out of all sessions. I gave a scammer my password has the order.
• A two-factor code — the account is probably already accessed; treat it as compromised.
• Personal details — change anything they could help reset, and consider a credit freeze if identity numbers were involved.
• Remote access to a device — disconnect it from the internet and get it checked before signing in to anything.

Then report it. How to report an online scam covers where, and what each agency does with it.

Key takeaways

• Verify through a channel the other person did not supply. That is the whole method.
• Caller ID, display names, badge photos and reference numbers are not evidence.
• Knowing personal details about you proves they have data, not authority.
• Genuine people and organisations never object to being verified.
• Scale the check to the stakes, and treat urgency as a reason to slow down.
• One sentence does most of the work: I will call you back on the published number.

What is social engineering explains why this single habit interrupts so many different scams, and impersonation scams covers the forms it most often takes.