Handle an account access request without falling for fraud

Help me handle an account access or ownership-change request safely. What they're asking for: [e.g. reset password, change account email, remove 2FA, transfer ownership, share data about an account] How they contacted us: [from the account email / different email / phone / chat / social] What I can see on the account: [recent changes, login locations, payment method last 4 digits - do not paste full details] Our verification policy: [PASTE - or "none written"] Anything that feels off: [urgency, story changes, pressure, mismatched details] Give me: 1. A risk rating (low / medium / high) with the specific red flags you see. Common social-engineering signs include urgency, authority claims, requests to bypass process, recent email or phone changes, and contact from a different address. 2. The verification steps I should require for this request, following my policy, and what I must never accept as proof (e.g. information that's publicly findable). 3. A reply asking for verification that doesn't reveal any account details or confirm the account exists. 4. A reply for if they fail or refuse verification. 5. When to escalate to security or trust and safety. Rules: never share or confirm personal data, ask for passwords, or bypass 2FA because someone is upset. Being slow is better than handing an account to the wrong person.