Verified
The registered person approved this exact request on their trusted device. You can act on it.
Use cases
Phishing and impersonation
Verify the request through a channel the attacker does not control, instead of judging whether a message looks genuine.
The problem
Phishing works because judging a message is hard
Modern phishing copies branding exactly, registers a domain that reads correctly at a glance, and relays what you type to the real site in real time. Advice to "look for the signs" asks people to win a contest they were never equipped for.
What changes
Stop grading the message. Check the request.
The verification does not happen in the email or on the page that arrived. It happens on a device already registered to the account, showing the domain that actually made the request. A look-alike domain produces a different request, and the credential simply will not sign for it.
How this works
Verifying a suspicious request
- Something asks for a sensitive action An email, a message, a call, or a page that looks like the real thing.
- The request is restated by REAL AUTH Where the organisation has integrated it, the request appears on the trusted device with the real domain and the real values attached.
- The person approves or refuses On the device, not in the message. Refusing is recorded and can be reported.
- The result is unambiguous Approved, refused, or not verified. A missing answer is never treated as consent.
Possible outcomes
Four answers, and one of them is silence
A verification request has more than two endings. Treating anything other than an explicit approval as approval is how verification systems fail people.
Rejected
The registered person saw this request and refused it. Treat it as fraudulent and report it.
Not verified
Nothing was proven, either way. Do not act on the request until you confirm it independently.
No response and Not verified are never shown as approval, and they never turn into approval by waiting.
Honest limits
What this does not fix
REAL AUTH does not detect phishing, filter mail, or tell you a website is fake. It only helps where the organisation being impersonated has integrated it — an attacker impersonating a company that does not use REAL AUTH is unaffected. It is a way to confirm real requests, not a way to spot false ones.
Related use cases
Secure login
Verify who is signing in, from which device, into which account, with which role — before the session exists.
Learn more →Business impersonation
CEO fraud, fake suppliers, fake support desks. Check that the person is real and that they hold the authority…
Learn more →Payment fraud
Confirm the exact amount, beneficiary and destination account, bound together, before the money moves.
Learn more →Try it against your own application
A free sandbox, real flows, and no card required.