The direct fix: verify the channel, not the voice
Treat any voice request for a wire transfer, password reset, or MFA bypass as unverified until it is confirmed through a second channel. This applies whether the voice sounds exactly like your CEO or not. Voice cloning tools are now good enough that a short public recording, a talk or a recorded call, can supply enough material to generate a convincing clone. Once that is true, "it sounded like him" stops being a valid control.
Why this is not the same problem as a fake email
A phishing email gives the reader time to pause, hover over a link, or forward it to a colleague. A live phone call does not. The caller sets urgency, claims authority, and expects an immediate action: approve the transfer, reset the password, read back the MFA code. The same pressure works against a finance clerk processing a wire and against an IT helpdesk agent resetting a login. Both are impersonation attacks on a human decision, not just a financial attack.
Build a callback verification protocol this week
This is a process change, not a technology purchase, so it can roll out without waiting on budget approval.
- Set a callback rule: whoever receives the request hangs up and calls the requester back using a number already on file in your internal directory, never a number the caller supplies.
- Use a code phrase for financial requests above a threshold your finance team sets, agreed in advance and never generated or confirmed live on the same call.
- Require two people to approve any wire transfer or sensitive credential reset, so one pressured employee cannot complete the action alone.
Who owns what
Finance leadership owns the wire transfer rule and threshold. IT or the helpdesk lead owns the credential reset rule. Both should be written down, not assumed, and reviewed when staff change.
Verify it works before you trust it
Run a tabletop test: have someone call the finance team or helpdesk posing as an executive with an urgent request, and watch whether staff follow the callback rule or skip it under pressure. If they skip it, the gap is training and authority, not technology, and that is what needs fixing first.
What the protocol does not cover
A callback rule assumes the directory number is trustworthy and that no other channel has been compromised at the same time. If an attacker has also compromised an email account, they can send a confirming message right after the call, which makes the callback feel redundant even when it is not. Also remember that approving a password reset under pressure does not automatically revoke sessions already active on that account. If a reset happens, separately force sign-out of existing sessions and check for newly registered devices or MFA methods. A compromised credential reset and an unrevoked session are two different problems. Fixing one does not fix the other. Having an incident response plan ready for this scenario, through our incident response service, matters because how fast you contain a bad reset is what limits the damage, not the callback rule on its own.
When to add detection tools, and when to wait
The callback and dual-approval protocol costs little beyond staff time and training, so there is no reason to delay it. Voice-authentication or deepfake-detection tools are a separate, added layer with their own cost and integration effort. Evaluate them based on how much voice-authorized financial or credential risk your business actually carries, and only after the low-cost protocol is in place and tested. If your tabletop test shows staff reliably follow the callback rule, a detection tool is a secondary investment, not an urgent one. If staff struggle to follow the rule even with training, that is the signal to prioritize a technical control sooner. A virtual CISO engagement can help weigh that decision against your actual exposure instead of against general worry about the headline.
Action checklist for this week
- Write a one-page callback and dual-approval policy for wire transfers and credential resets, owned by finance and IT respectively.
- Run one tabletop test with finance and one with the helpdesk, and record whether the callback rule was followed.
- Confirm your process for forcing session sign-out and reviewing new device or MFA registrations after any credential reset.
- Review the policy when staff, vendors, or finance signing authority changes, since a stale directory number breaks the callback rule.
Where to go from here
This kind of impersonation risk sits inside a broader security program, not a one-time fix. If you want a second set of eyes on whether your current verification steps would hold up, our free security review is a low-friction place to start, and our managed security service can help keep the policy current as your team and vendors change.
Top comments (0)