Some requests can cause real harm if they come from the wrong person. Before you act on one, make sure it really comes from your customer.

What counts as a sensitive request

• Changing an email address, phone number, password, or login.
• Changing bank details, sending a payment or refund to a new account, or paying an invoice.
• Exporting or sharing personal or account data.
• Adding a new user or admin to a customer's account.
• Anything marked urgent that asks you to skip your normal steps.

Why a normal-looking message can still be fraud

• The "From" address can be faked. Email was built without proof of who sent a message.
• The account can be hacked. A message from the customer's real mailbox or phone can still come from someone else.
• The address can be a lookalike, for example acme-support.co instead of acme.com.

So a message that looks normal isn't proof that the request is real.

What to do

1. Slow down. Pressure, urgency and "don't tell anyone" are common signs of fraud.
2. Read the sender's email address, not just the name shown, letter by letter. The display name can say anything, and small changes like rn instead of m are easy to miss.
3. Confirm through a channel you already trust. Call the phone number you already have on file, or start a new message to the address on file. Don't just reply, and never use a phone number, link or address that appears in the suspicious message itself.
4. For payments or bank changes, always confirm with a known contact before you change or pay anything.
5. Send data only to the verified contact, and only what was asked for.
6. When in doubt, ask a teammate. Leave an internal note on the ticket so the next person sees what you checked.

If the request turns out to be fake

• Don't send any information or make any change.
• Add an internal note explaining what happened.
• Tell the real customer through the channel you trust, so they can secure their account.
• Follow your company's security process.