Blog
They called the number in the change. The scribe wrote verified.
At 14:18 Nora calls the phone that arrived in the 14:02 vendor edit. The contract number from 2 March is not dialed. The scribe writes that the vendor was verified out of band.
At 14:11 on 28 October 2026, Nora V (accounts payable) has ticket AP-4418 open on the bridge. At 14:02 the vendor record for Calder Logistics in bill-pay was edited. The contract PDF dated 2 March 2026 lists account ending 4481 and phone ending 2204. The edit replaces those with account ending 9033 and phone ending 4419. The request came from the address already on the vendor record. Invoice CL-1884, 42,000, is the payment the change is for. The plan says: a bank-detail change is not applied, and no payment is released against it, until someone calls a phone number that predates the request. The number in the change, and the number in the email signature, do not count. Do not write that the vendor was verified because someone answered. Nora calls the number ending 4419 at 14:18. A person answers, says Calder Logistics, and reads back the account ending 9033. Nora says that matches the ticket. She does not open the 2 March PDF. She does not call 2204. Marcus T (incident commander) says the callback is done, so AP can apply the change. Owen P (controller), who owns the vendor-change rule, is not on the call. At 14:26 the scribe writes that Calder Logistics was verified out of band and the bank change can proceed.
A weak record of those fifteen minutes reads:
Vendor verified out of band. Bank change approved.
A strong one reads:
28 October 2026, 14:11 to 14:26. Incident-response tabletop. Seats: Marcus T (incident commander), Nora V (accounts payable). Owen P (controller, owns the vendor-change rule) was not on the call. Inject at 14:11: ticket AP-4418. At 14:02 the vendor record for Calder Logistics in bill-pay was edited. Contract PDF dated 2 March 2026: account ending 4481, phone ending 2204. The edit sets account ending 9033 and phone ending 4419. Request from the address already on the record. Invoice CL-1884, 42,000. Plan: a bank-detail change is not applied, and no payment is released against it, until someone calls a phone number that predates the request. The number in the change, and the number in the email signature, do not count. Do not write that the vendor was verified because someone answered. At 14:18 Nora calls 4419. The person says Calder Logistics and reads back the account ending 9033. Nora says that matches the ticket. She does not open the 2 March PDF. She does not call 2204. At 14:22 Marcus says the callback is done, so AP can apply the change. At 14:26 the scribe writes that Calder Logistics was verified out of band and the bank change can proceed. Facilitator stops the sitting before anyone applies the edit. Nothing was applied in bill-pay. No payment was released. Follow-up: Owen puts the 2 March phone on the vendor card AP can open without ticket AP-4418, or writes why a number that arrived in the same edit counts, by 11 November 2026.
Both notes say the vendor was verified. Only the second shows that the number ending 4419 was written at 14:02 in the same edit as the account ending 9033, and that nobody called 2204. The first costs you the account. On the night this is real, invoice CL-1884 for 42,000 is approved against the account ending 9033 because a person at 4419 read that account back, and a reader in March thinks a number from 2 March was dialed. Nobody calls 2204, because the file says the vendor was already verified.
The number in the change does not count
Nora reached a person, and the person knew the company name. The plan did not ask whether someone would answer. It asked for a phone number that predates the request. The number ending 4419 does not. It was saved at 14:02 with the account the caller then read back. The contract phone ending 2204 was on a PDF dated 2 March, and it stayed in the PDF.
Which channel the bridge stayed in is a different fact, in the bridge post. That one is the thread a guest session could read. This one is which phone number counted as Calder.
A matching read-back is the ticket confirming itself
The account ending 9033 matched AP-4418 because the person was asked to confirm AP-4418. That is one source, read twice. The plan's sentence is about which number was dialed, not about whether the answer agreed with the open ticket. Writing verified out of band names a second source the room did not use.
The free plan self-check asks whether out-of-hours contacts and vendor escalation paths are in the plan, as phone numbers. The number ending 2204 is that kind of number. If Nora cannot open the 2 March PDF while AP-4418 is on screen, run that check before the next sitting. If you are already in the room, run the inject anyway. The finding is the number she dialed. Do not smooth it into a line that says the vendor was verified.
What the packet records
Write both numbers in the free evidence template: the plan sentence, the 14:02 edit (account ending 9033, phone ending 4419), the contract PDF dated 2 March (account ending 4481, phone ending 2204), the call at 14:18 to 4419, that nobody called 2204, that Owen was absent, and his follow-up with a date. Hang the inject on the business email compromise family in the scenario library. That family walks a vendor bank-detail change, a wire of 180,000 released before any callback to a known number, and a later note that the vendor has not been contacted on a verified channel. It does not have a minute where the number dialed is the one written into the vendor record in the same edit, and the scribe writes verified. Add this before any payment leaves, and do not fold it into a line that says the vendor was verified. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the number that was dialed. The evidence template sits with the other record formats in the template library.
The record shows that these named people called the number ending 4419 and wrote that Calder was verified. It does not show that a payment left, it does not show a recall, and it does not show that 2204 would have reached Calder's accounts payable. A call to the number on the 2 March contract, and the banking portal, are different records.
Bottom line: write the number that was dialed, and the date that number first appeared. Verified out of band is the smoothed version. The packet has to show the phone that arrived with the change.