The Scenario
Sterling Accounting Firm manages approximately 340,000 to a vendor account. We’re acquiring TechVision this weekend—you saw my LinkedIn post about the deal being close. This is the earnest money. I’ll text you the wire details.”
Richard’s first instinct was that the request was unusual. But the voice was unmistakably Jennifer’s. He had known her for 15 years and could recognize her speech patterns, accent, and even her typical phrasing (“back-to-back meetings,” a term she always used). The reference to the LinkedIn post about “the deal being close” was particularly convincing—Jennifer had posted about an exciting acquisition “coming very soon” exactly three days prior.
Richard said, “Jennifer, the board needs to approve any acquisitions. We have a process.” Jennifer responded, “The board is being notified separately. You know how these deals work—we need to show earnest money before the ink dries. Just send it. I have to jump on another call.”
The call ended. Richard sat at his desk conflicted. Within 30 seconds, a text message arrived with wire details: “Wire to TechVision Acquisition Account at Silicon Valley Bank. Routing: [details]. Account: [details].” The message came from Jennifer’s cell phone number (or so the SMS seemed—caller ID spoofing made it appear that way).
Richard’s training kicked in: CEO requests should go through established procedures. But the voice, the details, the urgency—they all felt right. And his instinct about the acquisition was true; Jennifer had posted about it. After 10 minutes of internal debate, Richard decided the risk of delaying the acquisition was greater than the risk of the wire being fraudulent. He initiated the $340,000 wire transfer.
By Thursday evening, the fraud was discovered when Jennifer attended a board meeting and mentioned to the CFO of the acquisition target that Sterling was sending earnest money. “We received nothing,” the target company said. Jennifer’s face went blank. “I didn’t authorize any wire.”
Richard’s follow-up investigation was frantic. He immediately checked the wire transfer. The account at Silicon Valley Bank existed—it appeared to be a legitimate business account. But the money was never there. Silicon Valley Bank’s records showed the account was closed three hours after the wire arrived, and the funds were transferred out through a series of cryptocurrency exchanges.
The investigation revealed that:
-
The voice was a deepfake AI: A sophisticated artificial intelligence model had been trained on Jennifer’s voice (likely using publicly available videos, interviews, and podcast appearances). The voice was 98% indistinguishable from Jennifer’s actual voice.
-
The caller ID was spoofed: The call appeared to come from Jennifer’s cell number using a technique called STIR/SHAKEN spoofing.
-
The LinkedIn post had been discovered through reconnaissance: The attacker researched Sterling Accounting, found Jennifer on LinkedIn, identified her as CEO, and found the post about the upcoming acquisition.
-
The SMS was sent from a spoofed number: The text message appeared to come from Jennifer’s cell phone but was actually sent from a VoIP service.
-
The “TechVision” account was a money mule account: The account was opened using synthetic identity fraud (fake credentials) and was controlled by someone in a different country. It existed only long enough to receive the wire and move the funds.
Richard immediately notified law enforcement (FBI), Sterling’s board, and Sterling’s cybersecurity insurer. The incident became a case study in emerging threats.
The FBI later informed Sterling that this was part of a coordinated campaign targeting accounting and financial services firms. The attackers had:
- Researched target companies to identify CFOs and CEOs
- Gathered public information about upcoming deals
- Created deepfake voices using AI tools (increasingly available and sophisticated)
- Conducted social engineering calls to CFOs
- Successfully defrauded five firms of approximately $2.1M in the previous six months before this incident
What Went Right
- The fraud was discovered within 24 hours: The acquisition target’s mention of “we received nothing” immediately raised a red flag. Three days is still rapid compared to fraud that goes undetected for weeks or months.
- The wire transfer was traced quickly: Law enforcement was able to identify the receiving account and track the subsequent cryptocurrency transfers, providing intelligence for other investigations.
- The firm had cyber insurance: While the insurance didn’t prevent the fraud, it covered most of the loss, protecting the firm’s bottom line.
- Immediate containment: Once the fraud was discovered, Richard ensured all previous wire transfer requests were verified through a different channel before processing.
What Could Go Wrong
- No voice verification procedure for wire transfers: A CEO requesting a wire transfer should require verification through a secondary channel (an in-person meeting, a video call, a phone number from the company directory, or a previously established code word).
- No limit on wire transfer approvals: CFO Richard could approve $340,000 based on a single phone call. Most firms require multiple approvals for large transfers, creating a check-and-balance.
- No unusual request protocols: A request from the CEO to wire money to an unfamiliar account should trigger additional scrutiny. At minimum, Richard should have walked to Jennifer’s office to verify.
- No instruction to report deepfake attempts: Sterling had no security awareness training about emerging threats like deepfake attacks. Richard didn’t know this was even possible.
- Reliance on voice authentication: The attacker successfully impersonated Jennifer because Richard trusted voice alone. Voice can be spoofed, deepfaked, or recorded.
- Public information enabling social engineering: Jennifer’s LinkedIn post about the acquisition gave the attacker specific, credible details to reference. Public information becomes a liability in social engineering attacks.
- No zero-trust approach to requests: Richard trusted the request from a “verified” caller. In a zero-trust framework, every request—even from the CEO—requires additional verification.
Key Takeaways
- Deepfake voice and video are now realistic enough to fool humans: AI-generated voices can mimic tone, accent, and speech patterns. Assume voice alone is not sufficient authentication.
- Pretexting becomes more powerful with specific, credible details: The attacker’s reference to the LinkedIn post about the acquisition made the request seem legitimate. Public information can become ammunition for social engineering.
- Large financial requests require multi-factor verification: Never approve large transfers based on a single call. Require in-person confirmation, video call verification, or a pre-established code word.
- Multiple approval levels protect against social engineering: If the wire transfer required approval from both the CFO and the COO, the second approver could have verified the request independently.
- Unusual requests should trigger elevated scrutiny: A wire transfer to an unfamiliar vendor should require more verification than a request from a known partner.
- Brand-impersonation via caller ID spoofing is trivial: Caller ID can be spoofed. Don’t trust caller ID. Verify by calling back to a number from your company directory.
- Security awareness training must address deepfakes: Employees should understand that voice, video, and images can all be faked. They should know to verify through secondary channels.
- Voice verification protocols must evolve: Behavioral biometrics (verification based on speech patterns, response patterns, and knowledge of shared history) are more resistant to deepfakes than simple voice recognition.
Related Cases
- case-email-security — How to verify the authenticity of email communications, similar challenges to voice verification
- case-security-awareness-training — Training employees to recognize social engineering tactics and emerging threats
- case-threat-actors — Understanding the sophistication of organized crime groups that conduct coordinated social engineering campaigns