Last year the scam was a sloppy email from “the CEO.” This year the voice on the phone can match pace, accent, and familiar phrases. Voice cloning tools moved from demo booths to commodity apps. The question for finance and ops is no longer science fiction: can someone call your company sounding like the boss and get a transfer approved?
Answer: yes, in some cases already, if your verification habits are weak. Answer also: you can block most damage with procedures that cost nothing but discipline.
What voice deepfakes can and cannot do today
With a few minutes of public audio (earnings calls, podcasts, LinkedIn video), attackers can synthesize convincing speech for short scripts. Live interactive “conversations” are harder but improving. Background noise and stress hide artifacts humans would notice in a quiet lab.
They cannot magically know internal codewords you never published. They exploit urgency and authority, not omniscience. That matches how deepfakes in business already worked with video; audio is just cheaper to deploy.
Real attack patterns on the phone
Fake executive urgent wire: “I am in meetings, no email, send now.” Caller ID may be spoofed. Voice matches memory.
Vendor impersonation: “Our bank details changed, here is the new PDF.” Voice plus email combo.
IT help desk push: “This is security, read me the MFA code.” Synthetic voice adds polish to classic vishing.
Each pattern targets a gap between sound and verification. Your fix is to separate identity from voice texture.
Why companies still fall for it
Payment paths optimized for speed. Culture that punishes slowing the boss down. Remote work means fewer hallway checks. Assistants who pride themselves on making problems disappear.
AI lowers the skill bar for fraud. The social engineering is old. The wrapper is new.
Defenses that work in week one
Callback rule: any payment or credential change gets confirmed on a known number from the directory, not the inbound call.
Dual approval: two humans for transfers above a threshold, with amounts that hurt if wrong.
Secret challenge words for finance team only, rotated quarterly, never sent by chat.
Delay phrases trained for assistants: “Happy to help after I confirm on Teams with you.”
These overlap common cybersecurity mistakes fixes: verify, don’t trust caller ID, don’t share MFA.
Training without fear theater
Play a short fake clip in a security briefing. Ask who would approve. Debate where process broke. Update the written policy the same day.
Record acceptable channels for money requests. Publish a one-page “how the CEO actually asks for payments” (hint: rarely by surprise phone call).
Technology helps, process wins
Some banks offer confirmation callbacks. Email security can flag display-name impersonation but not voice. Deepfake detection startups exist; few small firms should rely on them as primary defense.
Strong authentication for admin systems still beats synthetic speech at the login boundary. Passkeys and hardware keys reduce where a voice scam can land; background in passkeys instead of passwords helps IT explain why “read me the code” is never normal.
When video joins the call
Zoom deepfakes are rarer but trending for high-value targets. Same rule: out-of-band verification before money or data. For executive travel claims, use pre-shared logistics channels, not whatever link arrived last.
Agentic AI may soon place calls at scale; threat models expand in cybersecurity in the age of AI agents.
Incident response if someone paid
Contact the bank immediately. Document the call time, number, and instructions. Preserve recordings if you have them. Report to local cyber crime units where applicable. Review whether policy was missing or ignored; ignored policy is a training problem, missing policy is on leadership.
Practical takeaway
Voice deepfakes do not bypass a company that treats money and credentials like physical keys. They bypass companies that treat a familiar voice as proof. Slow down the moment money moves. The CEO can wait ten minutes. Fraud cannot.
Brak komentarzy:
Prześlij komentarz