In this case you should trust but verify: ask the person to detail his sources (he is making the request on behalf of someone after all) and approach them direc

In this case you should trust but verify: ask the person to detail his sources (he is making the request on behalf of someone after all) and approach them directly to get a better picture of the situation. If his sources are outside of the company or also not truthful then I'd also be at a loss :)