If email phone and voice can all be spoofed what are you supposed to trust?

This came up in a conversation recently and I didn’t have a great answer. We used to treat calling a known number or recognizing someone’s voice as a second check. But if an email can be spoofed and a phone number can be hijacked and a voice can be cloned then you’re still relying on something that can be faked. For normal stuff that might be fine. But for wire transfers sensitive files or major approvals it feels pretty shaky. What can I even use as a final identity check anymore?