3 ms·
One way to defeat this (kindof) is to institute a callback on the internally shared number. So it would have went like this: 1. scammer deepfakes CEO voic
by crankylinuxuser 7y ago
One way to defeat this (kindof) is to institute a callback on the internally shared number.
So it would have went like this:
1. scammer deepfakes CEO voice
2. demands X dollars transferred elsewhere
3. Employee hangs up and calls back using pre-shared phone#
4. Gets confirmation
Of course this can be somewhat thwarted by sim-stealing attacks. But this is just another layer of defense, that stops another 99.xxx % of attacks. Enough of those and these attacks would be infeasible.
- parliament32 7y agoOr you just don't authorize multi-million dollar unreversable transfers with a phone call? Processes for this kind of thing are in place for a reason.
- crankylinuxuser 7y agoWell, the obvious counterexample would be Fintech. Calls and messages over approved SEC communications methods can be and are normal operating procedure. But in this article's case, we're talking about $.243 million , which flies counter to "don't authorize multi-million dollar unreversable transfers". Not sure what your point was here.