callback

A callback is a security mechanism that disconnects an incoming connection and then initiates an outbound connection back to the caller's registered number or address. In network authentication, a remote user dials in, provides credentials, and the system disconnects. The equipment then calls the user back at a pre-registered phone number or network address, confirming identity before granting access. This two-stage handshake prevents unauthorized access by ensuring the connection originates from an expected location.

In telecommunications and early network security, callback was primarily implemented via modems and telephone lines. A user would connect to a modem pool, enter username and password, then wait for the system to ring back their verified number. This added a physical verification layer: if someone stole credentials, they couldn't access the system from an arbitrary location. The callback number was typically stored in the authentication server's database and matched against the login attempt.

Variants and Modern Implementation

Callback mechanisms exist in several forms. Traditional telephone-based callback was common in the 1980s and 1990s for dial-up network access. Radio systems use callback in similar fashion, disconnecting unauthorized transmissions and re-establishing contact only with registered stations. Modern implementations appear in VoIP systems, where a server can disconnect and ring back a user's registered endpoint. Two-factor authentication systems sometimes incorporate callback as a verification step, sending a code via return call rather than SMS.

Problems with callback include inflexibility when users are mobile or need to access from multiple locations. Updating registered numbers requires administrative intervention. Call forwarding and VoIP spoofing can circumvent callback security if not properly configured. Callback adds latency to login procedures and creates dependency on outbound calling capability from the server side, which can fail in network partitions or firewall restrictions that block outbound calls.

The term persists in security documentation despite declining use in consumer networks, where it has been largely superseded by token-based and challenge-response authentication. However, callback remains relevant in industrial control systems, remote equipment access, and high-security telecommunications where the cost of implementation is justified by the requirement for physical location verification.