The call came from a known number, the voice matched and the request was urgent. Every tell that staff were trained to spot was absent. Investigators say the attacker needed only a few minutes of public audio and an off-the-shelf cloning service.
Fixing the process
Companies are reintroducing call-backs on separate channels, mandatory second approvers and code words that are never written down. Voice is no longer an authenticator, and policies written when it was need rewriting.
Key takeaways
- Minutes of public audio suffice for a convincing clone
- Out-of-band verification is mandatory again
- Voice should not count as a factor
This story is part of our ongoing coverage of cybersecurity. We will update it as more details emerge.
