• Hang up and call back on a number you already trust.
• Never share an MFA code or approve a login you didn’t start.
• Banning vendor recordings won’t stop deepfakes, but verifying will.

In Part One, we met the fake CEO on the phone and six real companies that got the same call. Some lost millions. Ferrari and WPP lost nothing. Here’s what the winners did differently.

Why smart people say yes

Notice what isn’t on the list of reasons these worked: stupidity. Every person in these stories was a professional in the middle of a normal day. The tricks are old; AI just gives them a better costume.

Authority. We’re wired to comply with senior people, and attackers choose senior people accordingly.

Urgency. A fake deadline cuts off the time you would have used to check.

Secrecy. “Don’t tell anyone” removes the colleagues who would have said “that sounds off.”

Familiarity. A known voice (or face) feels like a credential. It isn’t one.

Politeness. Hanging up on your boss feels rude. Attackers count on that.

Crowds. The Arup employee saw several “colleagues.” When everyone in the room agrees, doubt feels silly. The room, in that case, was a script.

Attackers also pick their moments: end of day, end of quarter, an executive on a plane and unreachable. And there’s a bonus defect in our defenses: email has spam filters, but nothing screens the phone ringing on your desk. Mandiant notes that interactive voice attacks are harder for automated tools to catch than email lures, which is partly why they’re growing.

Tells: what to look for (and what not to rely on)

• Tells that have nothing to do with sound (reliable, because they’re about the situation):
• The request involves money, login codes, passwords, or access.
• Urgency and secrecy arrive together. This pairing is the scammer’s signature.
• It skips the normal process: “don’t bother finance,” “no need for approvals.”
• It comes from a new number, a new account, or a new channel, or the caller wants to move to another app like Signal or WhatsApp.
• They resist a callback, or offer you a number to call (theirs).
• They keep you on the line and walk you through steps, discouraging you from hanging up and checking.

Tells you can hear (don’t rely on these): odd pauses, flat emotion, audio that’s oddly clean, mispronounced colleague names, a voice that doesn’t react naturally when interrupted, glitches on unusual words. On video: lip-sync drift, strange lighting, blurry edges.

Audio and video tells are useful when they’re present and worthless when they’re absent. The Ferrari executive heard a near-perfect accent. Arup’s employee saw a whole team. If your plan requires out-listening a machine, you will eventually lose. That’s why the habits below don’t ask you to.

Six habits that beat it

1. Hang up and call back, on a number you already trust. Use the company directory, your phone’s contacts, or the official website, never the number the caller or the text message provides, and never the caller ID. A message to the person on Teams or Slack is a good second check. Hanging up on the “CEO” feels like a career risk. It’s actually a career asset: a real executive will respect it.

2. Make the process do the work. Payments, bank-detail changes, password resets, and MFA resets have approval steps for exactly this reason: so no single voice, however senior, can bypass them. Real executives follow the process. Fake ones want to skip it. If an urgent exception is truly legitimate, it will survive a ten-minute callback. (Help desk and IT teams: verify identity through a callback to a number on file or manager confirmation for sensitive resets. A face on camera is no longer enough.)

3. Never read out, approve, or type a code or prompt you didn’t start yourself. Anyone who asks for your MFA code, whether “IT,” “the bank,” or “the security team,” is not who they claim. Approve only logins you personally initiated. (The Wi-Fi saga in The Unfriendly Skies taught this same rule, with worse carpet.)

4. Use a question only the real person could answer, or better, a code word. Ferrari’s book question worked because the answer wasn’t public. Anything findable on LinkedIn won’t hold up. For teams that touch money or access (finance, help desk, executive assistants), agree on a challenge phrase ahead of time. Families should too. A code word can’t be scraped from the Internet if you never post it.

5. Treat “urgent” plus “secret” as an alarm bell. Legitimate confidential deals still involve legal, finance, and a paper trail. Keep a few lines in your pocket:

“Happy to help. I’m going to call you right back on your number in the directory.”

“I can’t do that by phone. Send it through the normal channel and I’ll act on it right away.”

“I’m looping in [your manager / finance] first. If it’s urgent, they’ll move fast.”

The real boss will be fine with all three. The fake one will get annoyed or disappear. Both outcomes are information.

6. Report it every time, even if you hung up, even if you’re not sure. Attackers work from lists. If one of us got the call, others did too. Send [IT/security contact] the number, the platform, what was asked, and when. And if you did act on a request, speed matters enormously: call IT and finance immediately, because the sooner banks and investigators hear, the better the odds of recovering money. There is no blame here.

Q&A: Should we refuse to let vendors record our video calls?

Fair question, and the honest answer has two halves: not as a deepfake defense, but yes to being deliberate about it.

Why a blanket ban won’t stop voice cloning. Cloning needs only seconds to minutes of audio, and our leaders’ voices are already out there: earnings calls, conference panels, podcasts, webinars, LinkedIn videos. In the Arup and WPP cases, the attackers built their fakes from public footage, and nobody had to be recorded by a vendor. Declining a recording closes one window in a house with a glass front. Our leaders aren’t going to stop speaking in public, and they shouldn’t.

Why recordings still deserve scrutiny, for different reasons:

• A recording stores more than a voice. It holds faces, names, internal jargon, reporting lines, and deal details. If a vendor is breached, that’s a ready-made starter kit for a tailored scam, which is exactly what step 1 of the recipe (“homework”) wants.
• Some vendors keep recordings indefinitely, share them with subcontractors, or use them to train AI models unless the contract says otherwise.
• Recording-consent rules vary by state and country, so participants need to be told. (Ask Legal for specifics.)

So decide by sensitivity, not by reflex. Before agreeing to a vendor recording, ask five questions:

1. Why do they need it? Would notes or a transcript do?

2. Where is it stored, and who can access it?

3. How long is it kept, and can it be deleted on request?

4. Is it used to train AI or shared with third parties?

5. Does everyone on the call know and agree?

Routine demos and training sessions are usually fine with a decent contract. Calls covering payment procedures, credentials, security architecture, or executive strategy are different: “we’d rather not record this one” is a perfectly normal sentence. A vendor who can’t answer the five questions has told you something about the vendor.

And whether a call is recorded or not, the real protection is identical: verify through a second channel and follow the process.

The sticky-note version

• A familiar voice is not proof of identity. (Neither is a familiar face on video.)
• Hang up, call back, on a number you already have.
• Money, codes, and access go through the process. Every time, no matter who’s asking.
• “Urgent” plus “secret” equals alarm bell.
• Report it, even if it fizzled. Someone else is getting the same call.

Back to Thursday, 4:47 p.m.

“Are you seriously telling me you don’t recognize my voice?”

You take a breath. “I do. And that’s exactly why I’m going to call you right back on your cell. Two minutes.”

If it’s the real CEO, there’s a pause, then: “Good. Do that.” (Possibly followed by a note to leadership about how well the team is doing.) If it’s a criminal, there’s a click. Either way, you didn’t wire anything, read out anything, or approve anything. You left at 5:02.

You don’t have to out-hear a machine. You just have to hang up and call back, a skill most of us learned around age 10 and have been using on telemarketers ever since. The real boss will thank you for it. The fake one probably won’t, and that’s how you’ll know.

Next up in the Cybersecurity Awareness blog series, “You’re on a Video Call with Six People. None of Them Are Real.” Deepfakes have moved from the phone to live Teams and Zoom calls. Same scam, more faces, and the same winning move: hang up and call back.

Case details come from public reporting; some companies were not named and accounts differ in minor details. This is a security-awareness article, not legal advice. Company policy takes precedence over general guidance.