Attackers establish trust by impersonating colleagues on new channels and numbers, then escalate to requests. Verifying any unexpected new contact through a known channel before trusting them stops the impersonation before it pays off.
“A new number claiming to be someone you know isn't proof.”