One of the simplest and most effective tricks scammers use is also the easiest to defend against once you know it: they give you their own phone number, email address, or website instead of the real company's. You call "back" and reach the scammer, not the bank or business. The fix is to never rely on contact details supplied by the person who reached out to you. Instead, find those details yourself, through independent sources. Here is how to do that properly.

Why the details someone gives you can't be trusted

Anyone can print a fake number on an invoice, put a lookalike email address on a letter, or send a link that looks like it goes to a real company. Caller ID can be spoofed to show a legitimate-looking name or number. A slightly misspelled domain can be nearly identical to the real one. None of this requires special skill, which is why it is so common. The only reliable defense is to source the contact information separately, from a place the scammer does not control.

Start from the official company or business registry

Most countries maintain an official registry where companies must be listed, often including a registered address and sometimes a registered contact. This is a good starting point because the scammer cannot alter what is on file there. Search the company's legal name (not just the brand name) and confirm:

  • The company is actually registered and active, not dissolved or struck off.
  • The registered address matches what the company claims.
  • The company number or registration ID matches what's on their invoices or website, if given.

Go to the website directly, not through a link they sent

Never click a link in an email, text, or chat message to "verify" a company. Instead, open a new browser tab and type the company's name into a search engine, or type the web address you already know from a previous, trusted interaction. Once on the site:

  • Look for a dedicated "Contact Us" or "About" page and note the phone number and email listed there.
  • Check that the domain matches exactly what you'd expect — watch for extra words, hyphens, unusual endings, or subtle misspellings.
  • Confirm the site uses a secure connection (the padlock icon), though remember this alone does not guarantee legitimacy — it only means the connection is encrypted.

Cross-check with independent sources

Don't rely on a single source. Compare what you find across several places:

  • A business directory or verification service (like xtrust.info) that lists company details and lets you check reviews from other users.
  • Search engine results — search the company name along with words like "scam," "complaint," or "review" to see what others have experienced.
  • Social media profiles that are clearly linked from the official website, checked for consistency in branding and activity history.
  • Printed materials you already trust, such as a bank statement, a previous invoice, or a card that came with a purchase, rather than anything sent in the suspicious message itself.

If the phone number, email, and website you find independently all match each other and match what the company used in the past, that's a strong sign of legitimacy. If they don't match what the scammer gave you, that's a major red flag.

Call the number you found, not the one they gave you

Once you have an independently verified phone number, call that one to confirm anything urgent — a payment request, an account issue, a "security alert." If someone contacted you claiming to be from a company, hang up and call the number from the official website or your own records instead of using any number the caller provides, even if they claim the first number was wrong or unavailable.

Watch for near-identical domains and emails

Scammers often register domains that look almost right: an extra letter, a hyphen, a different ending, or a similar-sounding word. Similarly, a fraudulent email may come from a personal-looking address or a domain that resembles the real one but isn't quite it. Always compare character by character, and when in doubt, go find the real domain yourself rather than assuming the one in front of you is correct.

A simple verification checklist

  • Do not use any phone number, email, or link sent to you directly — find your own.
  • Check the official company registry for the legal name, registration status, and address.
  • Navigate to the website by typing the name into a search engine or using a known bookmark.
  • Compare the domain and email address character by character against the real one.
  • Cross-check details on an independent directory or verification service and read recent reviews.
  • Confirm consistency across the website, registry, and any documents you already trust.
  • Call back only using the number you found independently.

Taking a few extra minutes to verify contact details through independent channels is one of the most effective habits you can build against fraud. Scammers rely on speed and trust; slowing down and checking for yourself removes their biggest advantage.