Pause
Name the requested action and the consequence if the claim is false. A pause is not a refusal; it creates room to choose a safer channel.
Verify
Check identity, context and authority outside the message. Use a saved number, typed domain, known colleague or official account rather than contact details supplied by the claimant.
Decide
Prefer reversible actions with records and recourse. If verification fails, stop. If it partly succeeds, reduce exposure and ask what evidence is still missing.
For a suspicious message, apply the same sequence with the local message red-flag checker.
Last reviewed
2026-10-08. See our corrections policy if something is unclear or wrong.