VerifiedCall: verify who is on a phone call

VerifiedCall is a website you open from your phone or computer to prove who is on a phone call. It is built for the moment when someone calls you claiming to be from IT, the help desk, or another trusted team and asks you to do something sensitive — reset a password, approve a sign-in, read back a code, or install software.

Instead of trusting the caller’s voice (which can be faked or spoofed), both of you sign in with your work accounts and swap a short code out loud. Each of you then sees who the other really is — their name, photo, and work email address — on screen, at the same moment.

VerifiedCall runs entirely in your web browser. There is nothing to install.

When to use VerifiedCall

Use VerifiedCall any time you are unsure who is really on the other end of a call and the call involves anything sensitive, for example:

• A “help desk” or “IT support” agent asks you to share or reset a password, MFA code, or recovery code.
• Someone asks you to approve a sign-in prompt, disable security, or grant access.
• A caller claims to be a coworker, executive, or vendor and the request feels urgent or unusual.

If anything about a call feels off, ask the other person to run a VerifiedCall check. A colleague will be able to. An attacker will not.

Opening VerifiedCall

Go to your organization’s recovery website and add /verifiedcall to the address — for example https://recovery.your-company.com/verifiedcall. Your IT team can give you the exact link.

The first screen asks which side of the call you are on:

• “Someone called me” — choose this if someone called you.
• “I’m making the call” — choose this if you are the one who placed the call.

Both people open the same VerifiedCall site and pick opposite sides.

How a check works

Whichever side you are on, the shape is the same:

1. Sign in with your work account, the same way you sign in to anything else at work. Nametag never sees your password.
2. Swap the code. Whoever received the call is shown a 6-digit code and reads it aloud. Whoever made the call types it in.
3. See each other. Both screens show who the other person is: their name, their photo from your company directory, and the work email address they signed in with.

Stay on the phone for the whole thing — it takes about a minute. The code is what proves you are both really on this call right now, so it only works while you are talking.

The code changes every 30 seconds. Always read the code on your screen right now — never a screenshot or an old one. If it changes while you are talking, read the new one. If a code is rejected, ask for the current one and try again.

Reading the result

• Confirmed — you see the account the other person signed in with: its name, photo, and work email address. That is solid evidence they hold a real account at your organization and are on this call right now. Check that it matches who they claim to be, then carry on.

• Timed out — nobody entered the code in time, so the check never finished. This is not a pass. Don’t share anything. Hang up and contact your IT or security team through a channel you already trust.

A confirmed account tells you the other person can sign in as that colleague — not the same as proving they are that person, which is what a government ID and a Spatial Selfie™ do in account recovery. It is also still up to you whether that colleague is allowed to make the request.

If you can’t sign in

Locked out, forgotten your password, or lost the phone with your authenticator on it? Choose Can’t sign in?

If your organization uses Nametag self-service recovery, you will be sent to prove who you are with your government ID and a Spatial Selfie™ — checked by Deepfake Defense™ to confirm a real, live person is present, not a photo, video, mask, or deepfake. You can then reset your password or MFA and come straight back to finish the check.

If your organization has not set that up, VerifiedCall will tell you so. Hang up and reach IT through a phone number or channel you already trust.

Never use a phone number that was given to you during the call you are trying to check. That is exactly what an attacker would offer.

Safety guidance

• No verification, no secrets. If a check does not finish, or the other person cannot or will not run one, do not share passwords, one-time codes, recovery codes, or approvals, and do not make account changes. A real colleague can verify.
• Being locked out is not a reason to skip the check. The “Can’t sign in?” route exists so a genuine colleague can recover their account and come back. An attacker cannot follow that path.
• Never read a code from a screenshot. The 6-digit code is only valid briefly and is meant to be spoken live during the call. Someone who already “has the code” without you reading it to them is a red flag.
• The code proves the call, not the person. Entering the code only links the two screens and shows you are both on the call right now. Who you are is proven by signing in.
• Take your time. There is no penalty for asking someone to verify, and no rush to act on an urgent-sounding request. VerifiedCall sessions stay open for up to an hour.
• Report suspicious calls. If someone cannot or will not verify, end the call and report it to your security or IT team.

What happens if it takes too long?

A VerifiedCall session lasts up to one hour, after which it expires and both sides see a “timed out” message. You can always start a new one.

The session also expires if the screen of whoever received the call stops responding for more than about 30 seconds — for example, if the browser tab is closed. If that happens, reopen VerifiedCall and start again with a fresh code.