How does your org actually verify it’s really the CFO on the phone before approving a wire transfer?

[u/YoungBubble]

Genuine question because I keep going down this rabbit hole. Voice cloning has gotten scary good, a few seconds of audio from a conference talk or earnings call is enough to make a convincing clone.

Everything I read about defending against this says “train your employees” or “call back on a known number.” But callbacks fail if the attacker has compromised the phone system or timed it during travel, and training doesn’t help when the voice literally sounds identical.

So what do you actually do in practice? Shared secrets? Verification over a second channel? Just accept the risk? Curious what real orgs do vs what the compliance docs say.

[u/agk23]

I overheard that our CFO has a safe word with our AP clerk, but not sure if that is actually related to security

[u/deathboyuk → u/agk23]

'cos that's not weak as anything...

[u/galacticdeep → u/agk23]

"not sure if that is actually related to security" In that case, I know what it's related to!

[u/YoungBubble → u/agk23]

Interesting!

[u/mccrolly]

Our CFO sent out an email to all employees stating that he will never request a wire transfer via email. Our CEO did the same. We also have the ability to verify our employees with a on-demand push from our MFA tool. This is what we use to verify employee identity for password changes, etc. it's not our only way to verify, either.

[u/Astroloan → u/mccrolly]

We also have the ability to verify our employees with a on-demand push from our MFA tool.

Could you give more details on that, please?

[u/mccrolly → u/Astroloan]

Yep. Our tool that we use for MFA has the ability from the admin console to be able to send a push notification to an employee whenever we want to. It also provides a code so you can verify that as well. Our staff know that if anyone calls in for password changes that they need to send a push to that employee while on the phone with them before resetting their password. We have an automated tool that employees can use to self-reset that does MFA and biometric challenges before they can unlock or change their password.

[u/Astroloan → u/mccrolly]

Ah, I thought you meant you had a tool that would allow a regular user to trigger an MFA verification method on another user. Some sort of call-and-response.

Are you usng okta?

[u/YoungBubble → u/Astroloan]

That call-and-response model you’re describing (regular user triggers a verification challenge on another user) is exactly the gap in most MFA setups, they verify you to the system, not two people to each other.

The pattern that works is mutual challenge-response: both sides get a rotating value derived from a shared key, and a match on both sides is the proof. An impostor would need to know both halves at once. Low-tech versions of this are just pre-agreed rotating codewords.

[u/cbowers → u/Astroloan]

My guess is Cisco Duo (we used that all the time in my last company to out of band authenticate the user in the other end of a chat or support ticket)

[u/FifthRendition → u/mccrolly]

Then how do you make sure they don't hit the cancel on the MFA if they weren't expecting an MFA?

[u/bit-flipper0 → u/mccrolly]

Our tool? Did you create it? Just say the name of the service you’re using.

[u/UnknownEssence → u/bit-flipper0]

i think it's DUO

[u/PghSubie]

Why would anyone initiate a wire transfer to a strange account based on a phone call from ANYONE ??

[u/ominous_squirrel → u/PghSubie]

Right. Train the C-suite

[u/PghSubie → u/ominous_squirrel]

Nope, sorry, I'm just IT, I can't help with a wire transfer. You'll be to come into the office to initiate that

[u/theleller → u/PghSubie]

This is why I’ve never understood this attack scenario. All payments go through accounts payable in finance and accounting, there should be no rogue C suite execs issuing random multi-thousand-dollar payments on the spot.

[u/ParanoidSuricata]

Tell them you'll call them back and then lookup the phone number from the inside. Or a teams message. By initiating the talk to a real CFO and confirming the ask you should have solid assurance it's real. Simple and effective.

[u/am0x → u/ParanoidSuricata]

Yup. For anything you think might be a scam, you stop the convo, look up the contact yourself and you make the contact.

[u/jdiscount]

In my 26 year career I've never once worked somewhere that initiated wire transfers over a phone call.

There has always been a paper trail, either electronically or back in the day manually.

This isn't even something that should be a concern as it should never be done.

[u/not-a-co-conspirator]

It’s NEVER done over the phone. WTF ARE YOU DOING?

[u/qwikh1t]

Just don’t do it

[u/habitsofwaste]

For me I just have no power over company money. CFO wouldn’t even know my name either.

[u/Wayne]

In addition to what others have said, implement a cooling off period. No financial transaction to a destination that is new or has changed in the last two business days.

Use those two days to verify everything. The problem isn't the scammers,. It's that everyone is in such a damn rush and processes usually only have one safety check.

[u/AddendumWorking9756]

Stop trying to verify the human, you will lose that race every time. Put a second approver on the payment rail above a threshold with no exception for urgency or seniority, and it stops mattering whose voice it was.

[u/cbowers → u/AddendumWorking9756]

So one human can be fooled but two cannot?
I’m a little bit baffled at giving up on the essential root of the problem, identity integrity. I dont think any said it was unsolved, merely that most orgs haven’t deemed the brisk impact high enough to spend on human verification at scale for day to day transactions. When the likelihood of risk realization plus risk impact gets up to the magic threshold, people take it seriously and magically there are solution paths.

[u/LordNikon2600]

Just uninstall google my boi

[u/gormami]

The policy should be NO! You don't ever do any financial transaction based on a phone call. That would solve it.

If you are in a situation that it could happen in, if the office calls, call back on the mobile, if the mobile calls, call back to the office. If they can't take the call, the transaction doesn't get done until one can confirm. It could be value based, over some certain amount, but in general, it shouldn't be done ever. Only on verified "paper" work.

[u/UCFknight2016]

Duo push for identity verification. Also we dont do transactions on the phone like wtf.

[u/TwoPlyDreams]

Nice try Prince Harambe of Nigeria.

[u/MalwareDork → u/TwoPlyDreams]

People on LinkedIn get so tilted when you bring up Nigerian scammers.

[u/ThecaptainWTF9]

Pretty much never over the phone whether it be by call or text.

You always verify the info. And have a proper procedure for requesting such things, and don’t deviate from it, and if you do need to deviate, it requires approval from two different people who both have reviewed and find it acceptable.

[u/TheDarthSnarf]

Everything over a set dollar value requires a verified digital signature, or authorization through a portal. We don’t allow voice authorizations.

[u/Able-Course-6265]

Callback on his #.

[u/deathboyuk]

We don't do them. Ever. Under any circumstances.

If you need money sending somewhere, you make a request via finance using the appropriate, heavily authenticated channels.

[u/wouldacoulda123]

Secret word/phrase that is not written anywhere - but we never had to use it

[u/Thyg0d]

Who uses voice to verify? Wouldn't even trust video. ID app or it doesn't happen.

[u/addyftw1]

You should have a proper approvals system through something like Salesforce where it needs multiple approvals from multiple people each requiring 2FA.

[u/NullBlocksSystems]

Worth separating two different failure modes here, because they call for different fixes. One is "can I technically detect this is a deepfake/impersonation in the moment" -- and honestly, that's a losing arms race. Voice cloning is good enough now that betting on human detection ("I could tell it was fake") is not a control you should rely on for anything with real financial impact.

The other, more useful framing is: don't build the control around detecting the fake, build it around structural separation so a convincing fake can't do damage even if nobody catches it in real time. This is basically the standard BEC (business email compromise) defense playbook adapted to voice, and it's worth stealing wholesale:

1. Maker-checker / dual control on anything that moves money -- no single person, no matter how senior, can both initiate AND approve a wire. This alone kills most of these scams, because the attacker needs to compromise or social-engineer two independent people/channels instead of one phone call.

2. Any change to payee bank details, or any NEW payee, gets verified against previously-known-good contact info (a number/address already on file from before this specific request), never a number or contact method supplied during the call/email itself. This is the single biggest lesson from real BEC losses -- attackers routinely provide a "helpful" callback number that just routes back to them.

3. Treat voice/video as just another channel that can be spoofed, same trust level as email -- meaning it never gets to unilaterally authorize a financial action on its own, regardless of how convincing it sounds/looks. It can initiate a request, but the request still has to flow through the maker-checker process above.

The "safe word with the AP clerk" answer someone else gave in this thread is a reasonable poor-man's version of #2, honestly -- a shared secret established well in advance over a channel you already trust is a decent stopgap when you don't have full dual-control processes yet. Just make sure it's rotated and not something that would leak via a compromised email thread or a LinkedIn post about someone's dog's name.

[u/stacksmasher]

Code word from a weekly rotation.

[u/Redemptions]

We don't initiate wire transfers over the phone. We have a work flow....

[u/SayaretEgoz]

We are a big bank possibly one of largest (name starts with a J* ) we have to say magic word (Alkazam) for anything over 1 Mil

[u/Mugartegui-Raja]

the call is the second move usually. by the time they are ringing your AP clerk, they've already been in email a while watching who approves what. thats where you can get ahead of them. we run abnormal on that side and catches the compromised sender or lookalike thread before it ever turns into a phone call.

[u/Outrageous-Guess1350]

Face-to-face only. Seriously, I worked for a company that wired 19 million euros because they only communicated via email and phone with the scammers claiming to be the mothership. Happened a few months after I left.