Artem Lyashanov on why voice and video verification no longer guarantee secure payment authorization
According to industry estimates, losses from deepfake fraud in the financial sector tripled in the past year alone, while voice and video synthesis has quickly moved from the category of expensive, complex tools into the category of tools available to everyone.
The central theme of this piece, as Artem Lyashanov argues, is a change in the very model of trust in financial authorization: why the voice and image of the person on the other end can no longer be treated as proof of their identity, and what control architecture businesses should build instead. Below are a specific case, an analysis of what made the attack possible, and a list of practical defences for treasury and finance teams.
The case
An employee in the treasury unit of a multinational company in Hong Kong received an email supposedly from the group's UK-based CFO. It concerned a confidential M&A transaction that had to be executed outside the standard approval cycle. A classic BEC (business email compromise) scheme would have stopped at this stage — on its own, the email looked like typical phishing.
BEC (business email compromise) is a type of fraud in which an attacker impersonates a company executive or partner in correspondence to make an employee transfer money to the attacker's account.
But then the employee was invited to a video conference where the participants included the CFO himself and several recognisable colleagues from the finance function.
The voices, facial expressions and the way the meeting was run all matched the people the employee dealt with during regular reconciliations. Following instructions received on that call, he made 15 payments totalling about 25.6 million dollars to five accounts. Verification after the fact — a call to head office to clarify the details of the secret transaction — revealed that nobody had called the meeting.
Hong Kong Senior Police Superintendent Baron Chan put it this way: "everyone he saw on the screen turned out to be fake."
The money was never recovered. The case became a reference point for the industry precisely because it bypassed not a technical control but the human authorization procedure — the level most financial organisations still rely on as their last line of defence.
Why the verification perimeter no longer holds
Fintech founder Artem Lyashanov notes that this case should be seen as an indicator of a shift in the threat model for payment infrastructure.
Several factors that, in his view, have tipped the balance in favour of attackers:
- A voice clone can be built from three seconds of audio, and the public profile of a CFO or treasurer (investor presentations, conferences) is by definition an open source of training data;
- The reconnaissance phase of the attack relies on publicly available information about the organisational structure;
- Social engineering exploits the very notion of deal confidentiality and thereby takes the transaction outside standard maker-checker control;
- The multimodal nature of the attack (voice, video and group social pressure from "colleagues" on the call at the same time) reduces the effectiveness of the behavioural indicators that security awareness programmes used to rely on.
By his estimate, losses from deepfake fraud in the financial sector tripled in just one year, and the average loss per incident in the corporate segment is already measured in hundreds of thousands of dollars.
Where control is shifting
The key takeaway for finance teams lies in redesigning the payment authorization architecture itself so that it does not depend on the authenticity of the communication channel, says Artem Lyashanov.
Several control mechanisms that should become a baseline requirement rather than an optional extra:
- Out-of-band verification. No change of bank details and no non-standard payment is confirmed within the same channel the request arrived through — only via a pre-registered, independent contact;
- Callback only to a number taken from the company's internal system, not to a contact given in an email or message, or provided by the other party during a call;
- Strict maker-checker with an unbreakable segregation of roles for any transaction outside the typical range of amounts or beneficiaries;
- Transaction risk scoring at the TMS/ERP level that automatically escalates payments that are unusual in amount, beneficiary or timing.
Organisations whose trust model is still built on recognising a voice or a face rather than on procedure remain the most vulnerable link in this chain, Artem Lyashanov concludes.
How we verify information
According to public guidance from NIST, ENISA and OWASP, as well as materials from CISA, the Microsoft Security Blog and the Google Safety Center, the key approaches to defending against social engineering today come down to independent verification and segregation of roles. We cross-check facts against primary sources and compare practical conclusions with the requirements of ISO/IEC 27001.
Our editorial principle is simple: no recommendation is published without a verifiable source, and every figure comes with its context and date.
Trust in payments must rest on procedure, not on a voice or a face. Verification is a rule that works regardless of who looks convincing. — Artem Lyashanov
