The Wake-Up Call
A friend recently shared an email from Kenny E, president of a trade association, warning his board about a phishing attempt. The scammers used real names from the organization to request money transfers. Lisa V caught it and raised the alarm.
This isn't new. But what IS new is how sophisticated these attacks have become with AI.
The Two-Phase Attack
Here's the pattern we're seeing:
Phase 1: The Hook
You receive a call from someone who sounds EXACTLY like your boss, family member, or colleague
They mention an "emergency" or "urgent request"
The voice is cloned from social media videos, podcasts, or public recordings
They ask you to call them back or transfer money
Phase 2: The Seal
When you call back, you reach their spoofed number
The "verification" feels real because you initiated the callback
By the time you realize something's wrong, money is gone
Why Traditional Verification Fails
Phone calls: Voices can be cloned with just seconds of audio
Caller ID: Easily spoofed
Email: Names and signatures are trivial to fake
SMS: Can be intercepted or spoofed
What Actually Works
1. Out-of-Band Verification
Never verify through the same channel. If someone calls, hang up and call them on a number YOU already have saved.
2. Safe Words
Establish code words in person with family and close colleagues. Something random that wouldn't appear online. Change them every few months.
3. The "No Links" Rule
NEVER click a link from anyone—even people you trust—without verifying through a separate channel first. Message them directly: "Did you send this?"
4. Limit Your Audio Footprint
Be mindful of how much of your voice exists online. Podcasts, videos, and voice messages are all training data for cloners.
5. MFA Everything
Multi-factor authentication on all financial accounts. It won't stop social engineering, but it adds friction.
The Bottom Line
The old rules of "verify the sender" don't work when AI can perfectly mimic the sender. We need new rules:
Assume all unexpected requests are fake until proven otherwise
Verify out-of-band on numbers/channels YOU control
Use safe words for high-stakes requests
Never click links without separate verification
Trust, but verify—through a completely different channel.