A report circulating in recent coverage claims that a cloned executive voice helped induce a bank to transfer about €95 million, without the attackers compromising a computer. The account remains reported rather than independently verified in the material available to us, but the control failure it describes is familiar: a voice was treated as authority, and urgency displaced procedure. One recent account describes the alleged incident, while another widely shared video makes a similar claim about a bank transfer. That video should be treated as an unverified report, not primary evidence.
The call-back must break the attacker's path
A genuine executive can ask for a payment. A convincing synthetic voice can do the same. Neither should be sufficient authority to release funds.
For payment approval, beneficiary changes, urgent treasury instructions and VIP servicing, the first control is a call-back through a trusted channel. That means using a known number or an independently sourced directory entry, not replying to the incoming call, message or email. The control should also require the operator to record how the instruction was authenticated and what evidence was checked.
Call-back is not a magic test. FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that attackers can generate synthetic audio and video responses to live prompts. Verification therefore needs to be designed around trusted transaction context, not simply whether a person can answer a challenge question.
Dual approval and escalation need to work under pressure
A second approver should review the transaction using the same trusted process, with no ability for the caller to nominate, coach or rush that person. Segregation of duties matters most when the request appears to come from a senior executive, a client in distress or a colleague who claims an established exception.
Escalation should be explicit. Staff need permission to pause a payment, a named route to treasury or compliance, and a clear threshold for involving the MLRO, risk team or incident response function. Security awareness training can explain why an attack is plausible. It cannot demonstrate that a person will pause a payment when a familiar voice says the matter is confidential and time-critical.
The Arup incident in early 2024 showed the same broader lesson. Per CNN Business, the company confirmed that an employee transferred about 25 million US dollars after an initial phishing email led to a deepfake video call. Arup CIO Rob Greig described it as technology-enhanced social engineering, with no systems compromised and no data affected.
For regulated firms, this is becoming a governance issue. DORA Article 26 requires threat-led penetration testing that addresses people, processes and technologies, with ethical boundaries for social engineering. In the UK, the Payment Systems Regulator's reimbursement regime has required banks to reimburse victims up to £85,000 per Faster Payments scam claim since 7 October 2024.
DeepBlocker's Vishing Readiness Assessment is a fixed-scope, authorised two to three week engagement. We place controlled calls against agreed workflows, then return sealed evidence showing who was fooled, which controls held, and where escalation failed. Entry pricing is around £9,500.
Subscribe to the intelligence, or ask us to measure whether your payment workflow would survive a synthetic caller.