Verification of a data recipient is disclosed, including: sending, to a server, a request for requested information, wherein the request includes identifying information associated with a user; receiving, from the server, at least two pieces of information over different transmission channels; sending, to the server, recovered security data that is generated based at least in part on the at least two pieces of information, wherein the server is configured to determine whether the recovered security data matches stored security data; receiving, from the server, protected requested information associated with the request; and using the recovered security data to recover unprotected requested information based at least in part on the protected requested information.