Call verification is the practice of confirming that the person on a call is who they claim to be before acting on their request. It matters because both traditional trust signals have failed: caller ID is trivially spoofable, and voices can now be cloned from public audio.
The methods
Caller ID / number matching
Checking the inbound number against records. Near-zero cost, near-zero security — spoofing services make any number appear. Useful only as a negative signal (an unknown number is suspicious; a known one proves nothing).
Knowledge questions
"What was the last invoice amount?" Weak against attackers who have compromised a mailbox — which is precisely who is calling.
Voice biometrics
Matching the caller's voice against an enrolled voiceprint. Strong against human impostors; increasingly stressed by cloning, which is why modern deployments pair matching with liveness detection and synthetic-speech scoring.
The callback (out-of-band verification)
End the call; dial the person back on a number independently on file. This shifts the trust anchor from anything the attacker controls (the inbound call, its caller ID, the voice) to something they don't (your records). It remains the gold standard for payment-affecting requests, and it's the control regulators and insurers increasingly expect.
Protocol enforcement
The meta-method: making the callback non-optional by holding the requested action — the wire, the detail change — until verification is logged. Every method above depends on a human remembering to apply it under pressure; enforcement removes that dependency, and produces the audit evidence that the control operated.
Choosing a stack
For contact centers: passive voice biometrics + synthetic-speech scoring for triage, callbacks for high-risk actions. For finance teams: enforced callbacks on all payment-affecting requests, with real-time voice scoring as an early-warning layer on vishing-exposed channels.