Look for bad spelling. Watch for generic greetings. Be wary of unfamiliar voices. For twenty years that advice was good enough. It no longer describes the threat — and continuing to rely on it is now itself a vulnerability.
Every piece of consumer scam guidance ever printed rests on a single assumption: that a fraudulent message will look different from a genuine one. Spot the difference, and you are safe. That assumption held because the people running scams were working with limited tools — bad translations, mailing lists, a script read aloud by a stranger.
Those limits are gone. Generative text produces fluent, correctly punctuated, contextually appropriate messages at no cost. Breach data supplies the details that make a message feel personal. A few seconds of audio from a social media post is enough to reproduce someone’s voice convincingly. The message no longer looks different, because there is no longer any reason for it to.
When the surface of a message tells you nothing about its origin, inspection stops working. Something has to replace it.
That something is person-to-person verification: the habit of confirming who you are dealing with through a channel or a method the other party cannot control, before anything of value changes hands. It is not a product you buy once. It is a small set of habits, most of which cost nothing, and one of which — the ability to ask a stranger for real proof — has only recently become practical for ordinary people.
The left column is what the advice was designed to catch. The right column is what actually arrives now.
What has not changed is the psychology. Fraud has always worked on the same two levers: trust and urgency. Trust supplies the reason to comply; urgency removes the time in which you might think about it.
Modern tooling has made the first lever dramatically cheaper to pull. Manufacturing familiarity — a known voice, a plausible history, a message that references something real about your life — used to require effort and research. It is now close to automatic. The second lever was always free.
This is why “trust your instincts” has quietly become bad advice. Instinct is calibrated on the old signals. When those signals are reproduced perfectly, instinct reports back that everything is fine, and it does so with complete confidence.
Each works on the same principle: the proof must come from somewhere the impersonator cannot reach.
Verify on a channel the other party does not control.
Contact arrives on one channel; confirmation happens on another that you established beforehand. The number must come from your own address book, a bank card or an official app — never from the message that prompted the doubt.
A passphrase agreed in advance, in person.
A word or phrase known only to the real parties, chosen offline and never typed into a messaging app. It answers the one question a synthetic voice cannot: not who do you sound like, but what did we agree.
A verified proof issued by a service, not a claim made by a person.
A live identity check produces a result the counterparty cannot fabricate: a real person, holding a genuine document, matching a stated claim. The proof comes from the verification service, not from the person asking you to trust them.
The first two cost nothing and should be in place regardless. The third matters where the first two cannot apply — between people with no shared history, no saved number and no prior relationship, which describes almost every marketplace transaction, rental viewing and private sale.
A buyer or seller using stolen photographs, or operating a hijacked account with years of genuine feedback attached. The pressure is always the same: pay a deposit now, or the item goes to someone else.
Move the identity question ahead of the money question. Require a live verification step, or a mutual check, before any deposit — and treat urgency about payment as the signal it usually is.
A few seconds of audio from a social post is enough to clone a voice. The call arrives from an unknown number, the voice is unmistakable, and the story is designed to make you act before you think.
Hang up. Call the person back on the number you already have. If they cannot be reached, call someone else who would know. Ask for the safe word. None of this is rude at the moment it matters.
Someone presenting as your bank, a delivery service, a tax authority, technical support — or a verification provider. The tell that used to work, an obviously wrong sender address, no longer applies.
Refuse inbound requests as a rule. End the contact and reach the organisation yourself using details you already hold or that you find by navigating to their site directly. Never through a supplied link or number.
The hardest part of person-to-person verification is not technical. It is that most people would rather absorb a risk than appear distrustful. Fraud has always depended on that reluctance, long before any of this was automated.
The reframe worth making is that verification is something you offer, not only something you demand. Going first changes the character of the request entirely. It becomes a shared protocol rather than a challenge — the digital equivalent of both parties putting their cards on the table.
A legitimate seller has no reason to object. A real relative will be glad the protocol exists. A genuine institution will not penalise you for hanging up and calling back. In each case, resistance to a reasonable verification step is itself the most informative signal available to you.
Both sides prove · Neither side exposed
None of these require expertise, and two of them require nothing but a conversation.
When someone contacts you on one channel, verify the claim on another channel you already controlled beforehand — a saved number, a known email address, an official app. Never a number or link supplied during the contact.
Set a spoken passphrase, in person, with family and close business contacts. Use it for any request involving money, travel, legal trouble or account access. Keep it off social media and out of messaging apps.
Before a deposit, a wire, a handover or a shared document, both sides prove who they are. Offer your own proof first — it makes the request reciprocal rather than accusatory.
A verification habit implemented carelessly can be worse than none at all, because it produces confidence without producing evidence.
A convincing fake verification page costs a fraudster almost nothing to build, and harvesting a document image plus a live selfie in one step is a considerably better outcome for them than a stolen password. So: never verify through a link sent to you by the person you are trying to verify. Start the check yourself, from a service you already use or by typing the provider’s address directly. This applies to us as much as to anyone — a message claiming to be from ProntoID and asking you to verify yourself deserves exactly the same suspicion as any other inbound request.
A fake verification page is trivial to build and is an efficient way to harvest a document image and a selfie in one step. If you did not go looking for the verification service yourself, do not use it.
Voice is now among the weakest identity signals available. It should raise your confidence that a conversation is worth having, and nothing more.
Any image of a green tick, a badge or a passing result can be copied, edited or borrowed from someone else. A result that arrives through the person being checked is not a result.
Manufactured time pressure exists specifically to prevent verification. A genuine counterparty can wait five minutes; that is the whole test.
Confirming that someone is who they say they are tells you nothing about whether they will honour the deal. It closes the impersonation route, not every route.
Zero-trust stopped being a corporate networking concept some time ago. The principle underneath it — that identity should be proven rather than assumed, every time, regardless of how familiar something feels — now applies as directly to a phone call from a relative as it does to a server request.
Verification will not make you immune. A person who is exactly who they claim to be can still be dishonest; pressure can still be applied through a genuine relationship; plenty of fraud never makes an identity claim at all. What verification does is close the single most productive route available to a modern fraudster, and it closes it cheaply.
Impersonation is the weapon. Proof is what takes it away.
Advice such as looking for poor spelling, generic greetings or obviously fake profiles was based on the limitations of the people running the scam. Generative text, synthetic voice and stolen breach data have removed those limitations. A message can now be fluent, personally accurate and delivered in a familiar voice, so the surface of the message no longer tells you anything reliable about its origin.
It is the practice of confirming who you are dealing with through a channel or method the other party cannot control, before value or sensitive information changes hands. It covers out-of-band callbacks, pre-agreed passphrases and identity assertions issued by a verification service. The common thread is that proof comes from somewhere the impersonator cannot reach.
If someone contacts you on one channel, you verify their claim on a different, independently established channel. The critical detail is that you must use contact details you already held — a number from your own address book or from a card in your wallet — not a number, link or address supplied during the suspicious contact itself.
Agree a word or phrase in person, keep it away from social media and messaging apps, and make it something not derivable from public information such as a pet name or a birthplace. Use it for any request involving money, travel, legal trouble or access to accounts. Agree in advance that nobody will ever be offended by being asked for it.
No, and the reluctance to ask is precisely what impersonation relies on. A legitimate seller, colleague or institution has no reason to object to a short verification step. Reframing the request as ordinary courtesy — something you offer as readily as you ask for it — removes the social cost that fraudsters exploit.
Yes, and this matters. A fraudster may send you a link to a convincing but fake verification page in order to harvest your document images and selfie. Never verify through a link supplied by the person you are trying to verify. Initiate the check yourself, from a service you already use, or navigate to the provider by typing the address directly.
Treat any inbound request to verify yourself with suspicion, whoever it appears to come from — including a message claiming to be from ProntoID. Legitimate organisations will not be troubled if you decline, hang up and contact them yourself through their published details. If the caller resists that, the resistance is the answer.
It removes impersonation as an attack route, which underpins a large share of modern fraud. It does not protect against a genuinely identified person who intends to defraud you, against pressure applied to a real relationship, or against fraud that never involves an identity claim at all. Verification is one strong control among several, not a complete defence.
Two people confirming each other before meeting, trading or handing anything over. Neither side sees the other’s documents.
The same idea applied to support desks and sales teams: run a real check, return a single answer, store nothing.
A verified identity held in your phone’s secure enclave, presented on your terms and never sent as an email attachment.
Know Your Pal lets two people verify each other before they meet, trade or hand anything over — without either one seeing the other’s documents.
Swiss-operated · Privacy-first · Your documents stay yours