When you have direct communications (via email, SMS, phone calls) with your customers about things that typically attract fraudulent impersonators (eg phishing bank instructions, requesting sensitive PII), what is the best way to authenticate yourself as the real company besides the regular methods (eg email with security features enabled) ? Do your customers sometimes proactively request extra measures?