We don't have any direct lines, we only have 800 numbers. Look for some things that don't quite add up. And your password's been in use for six weeks. Because he made a couple of very small but silly mistakes. The company's systems happens to change it's passwords every 30 days.
People can pick up on little details like that.
But they have to feel comfortable about it. They have to know that their boss isn't going to slam them into smithereens for asking the caller another question. Rushing is another sign. Name dropping is a biggie. They can look up the name of a senior manager in your annual report.