Trained finance staff stop a deepfake-backed wire request at a Connecticut investment firm
An investment firm in Connecticut with about 80 staff, a leader in its segment.
- Scale
- About 80 staff, 6 finance and operations staff, 3 approvers, 1 Microsoft 365 tenant
- Engagement
- Training program over 4 months, then quarterly drills
The challenge
The firm moves large sums for clients and funds by wire. Its operations staff received instructions by email and, increasingly, by phone and video, and the written procedure relied on each person's judgment. A convincing request that appeared to come from a senior partner or a known administrator would have met a busy team with no rehearsed response.
An investment firm in Connecticut, a leader in its segment, moves client and fund money by wire every day. Its operations team of six handles instructions that arrive by email and, more and more, by phone and video. The client is not named on this page. This is an illustrative case, built from patterns we see in this kind of firm.
The firm's procedure depended on judgment. An associate who received a request that looked and sounded right would approve it, and a cloned voice of a senior partner is precisely the thing that makes a request look and sound right. The partners wanted a team that would stop a convincing fake and a procedure that did not rely on anyone spotting one.
We trained by role. Operations and finance learned payment-change fraud and the callback rule. Executives and assistants learned how attackers gather public detail about them. The help desk learned to resist urgent reset requests, and new hires received a first-week module. Monthly phishing simulations and a one-click report button turned reporting into a habit, with a same-day reply to every report.
We also rehearsed the moment that matters. Every quarter we staged an email and a voice call asking for a changed instruction, timed the response and wrote up what happened. The written rule never changed: every new or changed instruction is verified by a callback to a number already on file, and any wire above a set limit needs a second approver who is not the person who entered it. Mail authentication at enforcement and phishing-resistant sign-in for approvers backed this up.
In the modeled outcome, a request supported by a cloned partner voice and a lookalike domain reached an associate, who followed the callback rule, reported it within minutes and held a wire of about $2.4 million. We present it as an example, not a promise: training and controls make a faked instruction insufficient to move money, but they do not detect every fake. Related reading: our Security Awareness Training service and the article on deepfake-proof payments.
What our team delivered
- Role-based training for operations and finance, executives and assistants, the help desk and new hires, in short sessions
- A written payment-change rule: every new or changed instruction is verified by a callback to a number on file, never one taken from the request, and logged
- A second approver for every wire above a set limit, in a payment tool where the person who enters a wire cannot release it
- Monthly phishing simulation with immediate coaching, and a one-click report button in Microsoft 365
- A quarterly wire-fraud drill with a staged email and a staged voice call, timed and written up
- Mail authentication at enforcement on the firm's domains, lookalike-domain monitoring and phishing-resistant sign-in for approvers
Result
In this illustrative case, a request supported by a cloned partner voice and a lookalike sender domain reached an operations associate, who followed the callback rule, reported it within minutes, and held a wire of about $2.4 million. That is a modeled outcome, not a promise: training and controls reduce the chance that a faked instruction moves money, they do not detect every fake.
Get this for your company
Related services with fixed prices and a written scope.
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
$5,400 per bundle, phishing simulation for 25 users
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
$1,000 per assessment
Show 3 more
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
$100 per team member, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
$12 per user, per campaign
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
A wire change is never approved on the request alone
An email or a phone call can be forged, and a cloned voice or face can pass for a colleague. The request is held, the requester is called back on the number already on file, and a second approver signs off before the payment is released or rejected. Every step is logged.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.