Know the usual red flags
Watch for urgency, a new email address that differs slightly from the one on file, a request to change the email or phone first, and refusal to use the registered address.
Verify with what the attacker lacks
Ask for something only the owner can see in the product, such as a recent invoice amount or a project name. Do not ask for details that can be found online.
Never reset to a new address on request
Send resets and changes only to the address already on file. If the customer lost access to it, use a slower route with extra proof.
Treat payment changes as high risk
Changing a payout account or card should need more checks than a password reset. Write the extra steps down and apply them every time.
Log and tell the owner
Record what was asked and what you checked. If the account was taken over, tell the real owner on the registered address and help them secure it.
Do not make it personal
Explain that the checks protect the account. Real customers accept this; people who push to skip it are telling you something.