Voice cloning has become cheap and good. A short clip of a person speaking, taken from a video or a podcast, is enough to generate a phone call that sounds like them. The technology is now widely available and the cost has fallen to near zero.
What this means in practice is that a phone call from someone you know is no longer proof that the person you know is the one calling. A relative asking for help, an assistant confirming a transfer, an executive approving an urgent payment: each of these can now be faked with reasonable accuracy.
The attackers using this approach are aware that you will not question a familiar voice. They use the same routes that have always worked for them (urgency, secrecy, plausibility) and they now have a way to add a voice you will not question.
The defence is to agree, in advance, on a way to confirm anything significant. A code word known only to family. A second channel for confirming a payment, regardless of how convincing the first one sounds. A pause before any action that cannot be reversed.
·
The desk treats voice-based attempts as a recurring risk for clients whose voices are publicly available in any form, and works with them on what to put in place before they need it.
More from the desk
How the desk handles an uncertain finding
The trail of an early-stage investment
How a service provider becomes a vulnerability
Agricultural land and the registers that record it
The household as an information channel
How the desk tells the client what was not found