Cloned voices hit money managers: one check stopped them
Cheap voice cloning has made impersonation calls easy to run at scale. The defence reported by Inc. is unglamorous: verify every sensitive request through a separate channel.
Attackers used cloned voices to target money managers on Wall Street, according to a report by the US magazine Inc. A hedge fund managing $75bn stopped the attempts.
The method is not new. Impersonating an executive on the phone to move money has been tried for years.
What has changed is cost. Voice cloning is now cheap enough to run against many targets at once rather than one at a time.
The control that experts cited by Inc. recommend is a single rule. Any sensitive request gets an independent check before anyone acts on it.
Independent means the check does not travel down the same channel as the request. A caller who says they are the chief executive is verified by ringing back on the number already on file, not the number they are calling from and not one they supply.
For a startup finance team of two or three people, that is a process change rather than a purchase. Write down which requests count as sensitive, agree who calls back, and make the callback mandatory even when the voice is familiar.
The awkward part is social, not technical. Someone junior has to be allowed to make the finance director wait five minutes while they confirm it is really the finance director.
The Gazette could not retrieve the full Inc. article, so the specific procedures the fund used are not published here. The principle above is what the source states.