It is important to verify the legitimacy of requests for sensitive information through a secondary communication channel different from the one used for the initial contact. Directly contacting the supposed source by phone or in-person is a best practice to confirm the authenticity of the request, as email addresses can be spoofed to look like they come from a trusted individual. However, it is possible for a phone call to be part of the scam as well, especially if the phone number provided is part of the phishing attempt. Therefore, using known contact information (not provided in the email) to initiate the secondary verification is critical. Avoiding using the email reply option prevents falling for email address spoofing, and using pre-verified contact information helps ensure the conversation is with the actual trusted source.