Callback verification at a bank: when the phone on file just changed

Callback verification at a bank is the control in which staff confirm a risky request by calling the customer on contact details the bank already trusts, never on details supplied with the request. It fails in one predictable way: account takeovers begin by changing the phone number on file, so a callback to "the number we have" reaches the fraudster if that number changed last week. A sound procedure therefore picks the number from history, not from the current field, scripts the call so it never reads the request back, and treats a change to the phone itself as a change that needs verifying through another channel. Botminds' Account Maintenance Requests is account maintenance request software whose Callback agent chooses a number that has been on file for at least 90 days and is not in the request, drafts the script, and leaves the call and its outcome to a specialist.

This guide is for the deposit operations manager who writes the callback procedure, the fraud lead who sets its thresholds and the contact center leader whose staff take the phone changes. The worked case is a fictional customer at a fictional sample bank; public figures are linked where they appear.

What is callback verification at a bank?

It is an out-of-band check: the bank confirms a request through a channel the requester did not choose, by calling the customer on a number already associated with them. Banks use it for wires, payee changes, vendor bank details and account maintenance. Its value rests entirely on independence. A callback to a number in the request, or to a number added by the same person who sent the request, confirms only that the fraudster answers their own phone.

Regulators frame contact changes as authentication events for that reason. The FFIEC's 2021 guidance lists "Account Maintenance Controls" among its examples of effective controls and names changes to contact information and enrolled devices among activities warranting stronger authentication (FFIEC, Authentication and Access to Financial Institution Services and Systems). NIST's digital identity guidelines are more precise: "Setting or changing the pre-registered telephone number is considered to be the binding of a new authenticator" (NIST SP 800-63B-4, July 2025). A phone change is a change to how the customer proves who they are.

Why does a callback to the number on file fail?

Because the number on file is the first thing a takeover changes. Once the phone is diverted, the codes, alerts and callbacks follow it. FinCEN's analysis of identity-related suspicious activity found attackers "impersonate others to evade validation," "circumvent or exploit insufficient verification processes" and "use compromised credentials to gain unauthorized access during authentication" (FinCEN Financial Trend Analysis, identity-related activity). A callback procedure that dials the current phone field is an insufficient verification process in exactly that sense.

Threat actors frequently have used social engineering and other techniques to deceive customer call center and IT help desk representatives into resetting passwords and other credentials.

FFIEC, Authentication and Access to Financial Institution Services and Systems, 2021

The phone can also be taken at the carrier rather than at the bank, through a SIM swap or a port-out. The FBI's complaint counts for SIM swaps have fallen, but they are self-reported and say nothing about bank-side phone changes, which are not counted separately at all.

Choosing the number: the rules that make a callback independent

The number should be one the bank has trusted for long enough that a takeover is unlikely to have placed it there, and it must not appear anywhere in the request. The sample bank's rule is a number on file for at least 90 days and not in the request, never a number changed in the last 90 days. The period is a setting, from 60 to 180 days; the principle is that the bank's history, not the current field, decides.

NIST puts the porting point in its own words: verifiers "SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior) before using the PSTN to deliver an out-of-band authentication secret." It also classes the phone network as a restricted authenticator, the only one at publication. A bank that sends a one-time code to a just-added number, and treats a correct reply as verification, has proved only that the requester controls the number they added.

Notice before change: telling the old contact first

The control that protects the callback is notice to the old contact details before a change takes effect. NIST requires that account events such as binding an authenticator "require the subscriber or someone designated by them to be independently notified," and that services support at least two notification addresses per account. The FCC adopted the same idea for wireless carriers in 2023, requiring notice of SIM change requests and specifying "that the notification must be sent before a wireless provider effectuates a SIM change," so it does not go to the bad actor (FCC Report and Order, 88 FR, December 8, 2023).

A bank that confirms phone changes only to the new phone has built the opposite control. The same applies to address changes, where the Red Flags guidelines expect a bank to verify the validity of a change of address request on an existing account and treat a card or added user requested shortly afterwards as a warning sign (12 CFR 41, Appendix J). Change of address identity theft, traced follows the mail side of the same sequence.

Scripting the call so it verifies rather than confirms

A callback should let the customer describe the request, not agree to one read out to them. "Did you ask us to change your address?" invites a yes from a confused or coached customer; "We received a request on your account last week; can you tell me what you asked us to do?" does not. The script should also ask at least two questions whose answers are not on the form and never ask for a one-time code.

The no-tipping-off line matters in practice. A bank may not disclose a suspicious activity report or "any information that would reveal the existence of a SAR" (31 CFR 1020.320(e)). A specialist who tells a caller the request "has been sent to our fraud investigators" may have said too much, and on a takeover the person who hears it may not be the customer.

Which requests need a callback, and how fast?

Requests that change who can be reached, who can draw on the account, or who inherits it need one when the account shows takeover or exploitation signals. The sample bank requires a callback before any change at a takeover score of 0.40 or more, within four business hours of the hold, with the record unchanged while it waits. Clean, low-risk changes, such as an address that matches a permanent postal change of address with no signals in 90 days, go to a group check instead.

Volume decides whether the deadline is real. On one sample Monday, 155 of 2,214 requests carried a takeover signal. By our estimate, choosing a safe number and making the call takes about 15 minutes of a specialist's time when the number has to be found by hand, and about 8 when it is chosen and the script drafted in advance; the call itself does not get shorter. What one account maintenance request costs sets those minutes beside the rest of the request.

A sample case: the callback that went to the landline

At the sample bank, a mailed form for an 81-year-old customer asked to move her mail to a private mailbox, name a "nephew" payable-on-death beneficiary on $279,210.55 and mail a replacement debit card to the new address. The form gave the beneficiary's phone as a mobile number. That number had been put on her account six days earlier by a contact center call that skipped the one-time code, the day after someone posing as the bank's fraud department persuaded her to read out a code.

Hold for a callback: the number to call, and the number never to call

The current phone field held the fraudster's number. A procedure that dialled it would have confirmed the request. The Callback agent chose the landline on file since 2009, which was on the signature card and had been taken off the account by the October call, and drafted a script that asked two questions not on the form. The specialist called at 9:34 a.m.; the customer said she had never sent a form and described the call from "the bank". The request was declined at 9:38 with nothing changed, and the case went to the elder financial protection specialist with two linked requests that used the same mailbox.

The callback, scripted and summarised, with the outcome recorded by a person

The case is typical of where callbacks matter most. FinCEN found that the majority of elder scam filings in its 2022–23 review also referenced account takeover (FinCEN Financial Trend Analysis, April 2024). Older customers who answer the landline when "the bank" calls are the customers this sequence is built for, and their landline is often the safest number the bank holds.

What the callback file should prove to an examiner

That the call was independent, made by a person, and decided the outcome. The file should show the number chosen and why, the number not called and why, the script, who called, when, for how long, and the outcome in the customer's words, then the decision and the second person who checked it. A note that says "called customer, confirmed" proves none of that.

Segregation of duties on the maintenance desk covers the maker-checker split the callback sits inside, and twelve questions for comparing account maintenance software includes how to test a vendor's callback logic before buying.

Questions people ask

Should a bank text a code to a new phone number to verify a change?

Not as proof that the request is genuine. A code to a just-added number proves only that the requester controls it. NIST classes the phone network as a restricted authenticator and advises considering SIM change and number porting before using it; the safer step is notice to the old contact details before the change takes effect.

What if the only phone number on file was added recently?

Then the bank has no independent number, and a callback cannot do its job. Verify in branch, by a letter to an address of record that has not recently changed, or through another long-standing channel, and hold the change until then.

Can a bank change a customer's phone number over the phone?

It can, but a call is the channel attackers use most. The FFIEC's 2021 guidance says threat actors frequently deceive call center staff into resetting credentials. A phone change taken on a call should require stronger authentication than knowledge questions, notice to the old number, and a look at recent device and password activity.

Who should make the callback, the person who keyed the change or someone else?

Either can call, but the person who chose the number should not be the only one who checks the outcome. At the sample bank the agent chooses the number and drafts the script, the specialist calls and records the outcome, and a second specialist checks before anything posts.

How long should a callback number have been on file?

Long enough that a recent takeover is unlikely to have placed it there. The sample bank uses 90 days, with options of 60 and 180; longer periods are safer but leave more customers without a usable number, who then need another channel.

What should the bank tell a customer who denies the request?

That the request was not processed and nothing on the account changed, and how to reach the bank through its published number. It should not mention referrals, investigations or reports, both because SAR confidentiality forbids revealing a report and because the person on a compromised line may not be the customer.