A Texas title company stops a deepfake wire-change request with callback and second-approver controls
A title and escrow company in Texas with about 35 staff, a leader in its segment.
- Scale
- About 35 staff, 3 closers, 2 approvers per disbursement, 1 Microsoft 365 tenant, 4 mail domains
- Engagement
- Eight weeks to put the controls in, then ongoing operation and quarterly drills
The challenge
Closing funds move by wire, and the firm's closers received change-of-instruction requests by email and sometimes by video call. Voice and video can now be faked, and a polite request from a familiar face is exactly what a wire fraudster wants. The firm's procedure relied on a closer's judgment, with no written rule for who verifies a change, how, or who must approve the release.
A title and escrow company in Texas with about 35 staff moves closing funds by wire every day. Its closers received change-of-instruction requests by email and sometimes on a video call, and the procedure for handling them rested on each closer's judgment. Voice and video can now be faked well enough to pass a casual look. A familiar face asking politely to change an account number is the oldest wire fraud with a new costume, and nothing in writing told a closer who must verify the change, how, or who must approve the release.
The central control is the callback. Any new or changed wire instruction is verified by calling a number recorded when the file was opened, never a number taken from the request or the video call, and the closer logs the call on the file. The control works because it does not ask anyone to decide whether a face or voice is real. We wrote the procedure in plain language, set the dollar limit above which a second approver is required, and moved disbursements into a payment tool where the person who enters a wire cannot release it.
Email came next. The firm's four domains were put on SPF, DKIM and DMARC at an enforcement policy, so a message that spoofs them is rejected, and we added monitoring for lookalike domains that DMARC cannot stop, since a fraudster can register a near copy. External messages that mention wiring instructions carry a banner. We removed mailbox forwarding rules that hide mail from its owner, a common step after an account is taken over, and set conditional access on the Microsoft 365 tenant.
Closers and approvers moved to passkeys, which are phishing-resistant: the sign-in will not complete on a fake site. Once a request depends on the identity of the person who approves it, a stolen password should not be enough to approve anything. Each quarter the firm runs a drill with a staged email request and a staged video call, and the result is recorded and used to revise the procedure. Training repeats one rule: no instruction changes without the callback, however convincing the call.
In this illustrative case, a request arrived with a convincing video call and a lookalike sender domain, and it stopped at the callback step. About $412,000 stayed in the escrow account. That is one client's past result, not a promise to any other company, and the controls do not detect every deepfake. They make a faked instruction insufficient to move money. Callback conditions in an insurance policy are a matter for the firm's broker and counsel, and our article on deepfake-proof payments explains how the procedure is built.
What our team delivered
- A written payment-change procedure: any new or changed wire instruction is verified by a callback to a phone number recorded when the file was opened, never one taken from the request, and the call is logged on the file
- A second approver for every disbursement above a set limit, in a payment tool where the person who enters a wire cannot release it
- Mail protection with SPF, DKIM and DMARC at enforcement on all four domains, lookalike-domain monitoring and banners on external messages that mention wiring instructions
- Phishing-resistant sign-in with passkeys for closers and approvers, conditional access, and removal of forwarding rules that hide mail from the mailbox owner
- A deepfake drill each quarter: a staged video call and a staged email request, with the result recorded and the procedure revised from it
- Training for closers on the one rule that does not depend on spotting a fake: no instruction changes without the callback, however convincing the call
Result
In the firm's own past result, a request that came with a convincing video call and a lookalike sender domain was held at the callback step, and about $412,000 never left the escrow account. That is one client's outcome, not a promise: the controls do not detect every deepfake, they make a faked instruction insufficient to move money.
Get this for your company
Related services with fixed prices and a written scope.
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
$1,000 per assessment
Show 2 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
$18 per endpoint, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
A wire change is never approved on the request alone
An email or a phone call can be forged, and a cloned voice or face can pass for a colleague. The request is held, the requester is called back on the number already on file, and a second approver signs off before the payment is released or rejected. Every step is logged.
Payment-change callback flow
A request to change bank details is never acted on from the request itself. Someone rings the number already on file, a second person approves, the outcome is written down, and only then is the payment released or held. If any step fails, the old details stay in use.
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.