Independent-Source Verification
Confirm a sensitive request through separate channels before acting
- Difficulty
- Easy
- Time to result
- ~days to results
- Steps
- 5
- Confidence
- 97%
Suleyman expects criminals to use convincing generated voices and deepfakes, so he recommends greater skepticism and multiple independent authentication factors. When a sensitive request arrives, pause rather than acting on the apparent realism of the message. Identify the person, authority, and action that need verification. Then initiate contact through a separate trusted channel and require another independent factor, such as an established number, account, device, code, or known process. Compare the signals and refuse or escalate when they conflict. The mechanism is triangulation: a criminal who controls one voice, video, message, or account must also defeat separately controlled sources. The episode presents bank one-time passwords and two-factor authentication as existing examples, while predicting that more factors will become common.
Origin
Extracted from The Diary of a CEO
Core principles
- 01Convincing media is not sufficient proof of identity
- 02Independent channels reduce single-point deception
- 03Skepticism is a learned defensive adaptation
- 04Defenses must evolve as attacks improve
How to run it
- 1
Pause the request
Do not transfer money, disclose credentials, or change access solely because a message sounds urgent or familiar.
Pro tip Treat urgency as a reason to verify faster, not to skip verification.
Watch out Do not ignore a credible emergency; contact the person or relevant service independently.
- 2
Define the identity claim
Specify who appears to be asking, what authority they claim, and what action they want.
Pro tip Separate proof of identity from the emotional force of the story.
Watch out A familiar voice or face can be generated or replayed.
- 3
Open a separate channel
Contact the person or institution using a trusted route you initiate, not a number or link supplied in the request.
Pro tip Use a previously saved number, official app, or independently found contact path.
Watch out A second message inside the same compromised account is not independent.
- 4
Add another factor
Require a separately controlled signal such as a device prompt, one-time code, established account, or known verification process.
Pro tip Choose factors controlled by different systems where possible.
Watch out Never share an incoming security code with someone who contacted you unexpectedly.
- 5
Resolve conflicting signals
Stop the action and escalate through the official process if any source disagrees or remains unverified.
Pro tip Record suspicious contact for later review.
Watch out Do not let embarrassment about delaying override an unresolved identity conflict.
In the wild
A caller sounds like a relative and asks for immediate payment after an alleged accident. The recipient hangs up, calls the relative on a saved number, and confirms the story through another family member before taking any action.
→ The request is judged through independent signals rather than the realism and urgency of one voice.
Common mistakes
Trusting realism as authentication
A convincing voice, face, or writing style can no longer serve as the only proof of identity.
Verifying inside one compromised channel
Multiple messages from the same account do not provide the independence that triangulation requires.
Is it for you?
Best for
It is best for unexpected requests involving money, credentials, access, identity, or urgent changes of plan.
Not ideal for
It is not ideal as a replacement for professional incident response or emergency services when immediate physical danger is credible.
From the transcript
“Skepticism, I think, is healthy and necessary.”
“You have to triangulate between multiple separate independent sources.”
From the episode
Google DeepMind Co-founder: AI Could Release A Deadly Virus - It’s Getting More Threatening! Mustafa Suleyman