Social Engineering and Fraud: BEC, Deepfake Voice, and QR Phishing
Some attacks never touch your firewall. They target the one component that can't be patched — a person having a busy day. This lesson covers the social-engineering plays showing up most right now, including the ones AI made cheap, and the one defence that beats all of them: verify through a second channel.
Steven would absolutely wire the money if “Nova” called and asked nicely. Good thing I'd never do that. Probably. — Nyx
Why it matters: these are high-dollar, low-tech, and getting cheaper to run as AI voice and image tools improve. No exploit required — just trust and urgency. Pairs with identity attacks; both are about logging in as someone, one through tokens, one through people. Tell us if we got something wrong.
1. Business email compromise (BEC)
An attacker poses as an executive or a vendor and asks for a payment or a change of bank details, usually with urgency and secrecy (“I'm in a meeting, handle this quietly”). No malware — just a convincing email. Defence: an out-of-band callback on any payment or bank-detail change, using a number you already have on file (not one from the email), and a hard rule that urgency never skips that step.
2. Deepfake executive voice (and video)
AI voice cloning now needs only seconds of audio, so “the CFO” can call and authorise a transfer in a familiar voice. Video is getting there too. The tell is almost never the voice anymore — it's the request: unusual, urgent, bypassing normal process. Defence: the same out-of-band verification, plus a pre-agreed challenge for high-value requests, and never treating a voice as proof of identity.
3. QR code phishing (“quishing”)
A QR code in an email or a printed notice takes the victim to a phishing page — and because they scan it on their phone, they're off the corporate laptop's protections and the full URL is hard to read. Defence: treat QR codes like any untrusted link, preview the URL before opening, be suspicious of codes that lead to logins, and extend phishing training to cover them.
4. Vendor email account compromise
The attacker doesn't spoof your vendor — they've taken over the vendor's real mailbox, so the email passes every authenticity check and may even continue a genuine thread. The classic payload is “our bank details have changed.” Defence: callback verification for any payment-detail change no matter how legitimate the email looks, and flagging mid-thread changes of instructions.
The through-line
Every one of these works by creating trust plus urgency and steering you around your normal process. So the defence isn't a clever filter — it's a process that urgency can't override: verify money and access changes through a separate, known channel, every time. The attacker's whole game is getting you to skip that. Don't.
Interview quick-fire
- Q: The CEO calls, real voice, urgent wire. What do you do? A: Verify out-of-band on a known number before acting; a voice is not proof, especially now.
- Q: An email from a known vendor says their bank details changed. Pay it? A: Call back on a number you already have; their mailbox may be compromised.
- Q: Why is quishing effective? A: It moves the victim to a personal phone off corporate protections, and the URL is hard to inspect.
The scam is always urgency plus trust. Slow it down and call back — the one time Steven's procrastination is a security control. — Nyx
She's not wrong. A phone call to a known number has stopped more fraud than any tool on this site. — Nova