The call from the CEO that wasn't

Voice cloning has made a familiar scam faster. The script hasn't changed: urgency, authority, secrecy, and a payment. What's changed is that the voice on the line sounds right.

Why training alone won't stop it

People who've completed the awareness module still pay, because the attack is designed for the moment when they're busy, the request is plausible, and saying no to the CEO feels riskier than saying yes. Training raises suspicion. It doesn't give anyone permission to stop.

What does stop it

A control that doesn't depend on the target's judgement in the moment.

• Out-of-band verification for any payment change or urgent transfer, using a number already on file, not one given in the call.
• A rule that no single person can authorise above a threshold, enforced by the payment system, not by policy.
• Explicit permission to delay. The CEO, in writing, telling finance that any urgent request from the CEO should be verified and that no one will ever be in trouble for the delay.

That last one costs nothing and changes the whole dynamic. The scam works by exploiting fear of the boss. Remove the fear and the script collapses.

If it's already happened

Speed matters. The bank's recall window is short. Call the bank first, then counsel, then the investigation. Preserve the call recording and the emails; the headers and the timing are evidence. And don't let the person who paid carry it alone. They were attacked, and the control that should have protected them wasn't there.

The exercise worth running

Have someone call your finance team pretending to be an executive, with permission from that executive. Not to catch anyone. To find out whether the verification step actually exists, or only exists in the policy.

If you'd like help putting controls in place that hold under pressure, that's work I do.

Explore: More on fraud and phishing · Work with me