Out-of-band verification of payment and identity requests
A request to pay, change bank details or reset access is confirmed through a separate, known channel.
Layer L4 Infrastructure / target · Owner Organisation hit · Family The target's own defences
Effective
Not effective
Not effective (bypassed)
Did not exist
By risk
| Risk | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control |
|---|---|---|---|
| Fraud and impersonation | |||
| Unauthorised transactions or spend | 1 |
Why it was not effective
No incident yet records this control as not effective.
Incidents where it was not effective or did not exist per day
0 on 1 Nov 2026; average of the 7 days before: 0.
0 of 3 incidents in 1 Nov 2026 have been read for controls.
Added in reported fixes, and what followed
No reported fix names this control yet.
Frameworks
| Standard | Clause | Requirement |
|---|---|---|
| NIST CSF 2.0 | PR.AA-03 | To verify when the text is stored |