If the current account or device may be compromised, that same conversation cannot be the only proof of who is in control. The design uses a separately registered recovery route and checks the authority of the person responding. The available route depends on what has been configured. A new number supplied inside a suspicious conversation is not automatically trusted, and helping us make contact does not automatically give someone permission to release a critical hold.