Sure, this is a troubling new variation, but it's still the kind of social engineering that can be deflected with reasonable protocols, such as a second channel

Sure, this is a troubling new variation, but it's still the kind of social engineering that can be deflected with reasonable protocols, such as a second channel of authentication (e.g. "Sounds good boss, can you email me the transfer/order id to confirm things and I'll finish it from here". The underling CEO was as vulnerable to someone imitating his boss's voice the old-fashioned way. Regardless of the advances in AI, I think text-based social engineering will still be prevalent and efficient. IIRC, the Anonymous hackers who targeted HBGary got SSH access by fooling the company's chief security officer. Sure, they did by emailing from the company owner's account (thanks to a weak admin password surfaced through other vulnerabilities). But the hackers didn't even know the account name when asking for a password reset. The CSO could've stopped things by asking to do a call, e.g. "Hey let me call you, I need to walk you through this part" or even just texting the phone for confirmation. https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/3/ https://arstechnica.com/tech-policy/2011/02/anonymous-speaks...