Glossary
Out-of-Band Verification
Out-of-band verification confirms a request by checking it through a channel completely separate from the one the request itself arrived on — calling a known, previously established phone number to confirm an urgent email request, for instance, rather than replying to that same email or calling a number the email itself provided. The value depends specifically on the two channels being genuinely independent: verifying through a channel the original requester also controls doesn't actually add protection, since a party capable of faking the request could just as easily fake the accompanying confirmation channel too.
This is a specific, deliberate defense against exactly the scenario notification spoofing and social-engineering attacks rely on — a convincing request that would pass a check performed within the same channel it arrived on, but fails once verification happens through a channel the attacker doesn't also control.