Ilia Zavialov takes apart the fake support call that reaches a small team

01

What the call sounds like from the desk

The call arrives in the middle of something else. An employee is halfway through an invoice run or a support queue when the phone rings and a calm voice introduces itself as the service desk. It offers a name, a reference number and a reason: a licence sync failed overnight, a mailbox has been flagged, a payment file was rejected by the bank. Nothing in the first ninety seconds asks for alarm.

The second minute carries the real payload. The caller mentions a system the company genuinely uses, because that detail was collected in advance from a job advert, a supplier page or a public profile. It offers to sort the problem now so nobody has to raise a ticket and wait three days. Familiarity does the work that a threat would ruin.

By the third minute the request appears, and it is always small. Install a short session tool. Read out the code that has just arrived by text. Confirm the last four digits of the account used for supplier payments. Each step is harmless in isolation, which is the reason the sequence was split into steps at all, and only the caller can see where it ends.

02

Why the voice on the line sounds like someone familiar

The voice stopped being a weak point for the attacker. Work on voice cloning through 2025 and 2026 shows that a convincing copy can be built from a recording of roughly three seconds and reaches about 85 per cent accuracy. Three seconds is a voicemail greeting, a fragment of a conference talk, a welcome video on a company website.

Human ears do not make up the difference. In one experiment listeners separated a real voice from a synthetic one in only 37.5 per cent of attempts, which is worse than guessing. A team whose control is recognising the finance director by voice has built that control on a sense already measured and found weak.

Volume followed capability. Vishing with cloned voices was measured growing by 1633 per cent in a single quarter, which is what happens when a technique becomes cheap. Cheap techniques get aimed at small organisations, because small organisations answer their own phones and have no switchboard between the outside world and the person who can move money. A ten person company has the same voice surface as a bank and a fraction of the process around it.

03

The scale behind one ringing phone

A single call feels like bad luck. The aggregate reads differently. The Federal Trade Commission recorded more than a million impersonation reports for 2025 with 3.5 billion dollars of stated losses, close to one report in three across every category it tracks. Impersonation has become the default shape of fraud, and the telephone remains its most dependable delivery route.

The call centre subset is measured separately and it is large. The FBI Internet Crime Complaint Center counted more than 80 thousand complaints and over 2.9 billion dollars of losses for 2025 in the category that combines fake technical support with government impersonation. Business impersonation alone accounted for a billion dollars in the FTC figures, with the heaviest losses reported by people who believed they were speaking to staff at their own bank. The script that works on a customer works on an employee.

The same data carries a more useful number for anyone writing a procedure. In four impersonation reports out of five no money was lost at all, and the typical loss where money did move was around 700 dollars. A procedure aimed only at the rare expensive call gets forgotten, while a procedure that handles the ordinary weekly call stays alive.

04

What the caller is actually collecting

Remote access is the first prize. A short session tool installed by the employee hands over the screen, the saved sessions and the file shares, all from inside the network where no perimeter control applies. The employee stays on the line and watches a cursor move, which feels like supervision and functions as cover. Anything typed during that session belongs to the caller.

The second prize is a one time code. Multi factor authentication holds until a person reads six digits aloud to someone polite, so the whole attack often reduces to inventing a reason for that reading. The caller supplies the reason in advance, describing it as a verification step, a sync check or a security confirmation. The code itself arrives from a genuine system, which makes the request feel endorsed by the company.

The third prize is a payment instruction. Business email compromise accounted for 3.046 billion dollars in the 2025 IC3 report, second only to investment fraud, and a phone call is a common way to warm up or confirm a change of bank details. A voice saying the change was already sent by email removes the doubt the email alone would raise. The two channels vouch for each other while both belong to the attacker.

05

The pressure that makes a careful person move quickly

Every version of the script builds the same three conditions. Time is short, because a licence expires at five or a payment window closes today. Authority is present, because the caller speaks for the bank, the regulator or the head of finance. Secrecy is made to sound reasonable, because the matter is an audit, a security incident or a confidential acquisition. Under those conditions a competent adult acts against their own judgement and remembers afterwards that it seemed sensible at the time.

The script also works hard to keep the line open. The caller offers to wait while the employee checks, suggests staying connected during the installation, or asks to be transferred instead of called back. Ending the call is the single action that destroys the attack, so the attack is arranged to prevent it.

Guilt is the last lever and the strongest one inside a small team. Refusing a caller who claims to be a senior colleague feels like insubordination, and refusing a caller who claims to be the bank feels like obstruction. An employee weighing a small chance of fraud against a certain chance of embarrassment usually chooses to cooperate. Any procedure that ignores this arithmetic gets ignored in turn.

06

The procedure that ends the call

One rule carries most of the weight. Any request that arrives by phone and touches access, codes or money is answered by ending the call and dialling a number the organisation already held, taken from the internal directory, the signed contract or the card issued with the bank account. The number offered by the caller stays unused, and so does the number shown by caller identification, because the attacker chooses both.

The rule works because it converts a judgement into an action. An employee under pressure cannot reliably assess whether a voice is genuine, and the accuracy of that assessment has already been measured at well below chance. The same employee can reliably hang up and dial a stored number, which requires no assessment at all. Controls survive stress when they ask for a habit and leave evaluation out of it.

A callback also removes the attacker from the conversation entirely. If the request was genuine, the internal line or the supplier switchboard confirms it inside a minute and the work continues with a small delay. If the request was invented, nobody at the real number knows anything about it and the matter settles without argument.

That delay is the part management has to defend out loud. Employees abandon callbacks when a manager sighs at the second verification, and one visible sigh undoes a written policy. Saying plainly that a slow verified payment is a good outcome, and that a fast unverified one is a failure even when the money turns out to be fine, keeps the rule usable in practice.

07

Who is allowed to approve what

A phone call becomes dangerous wherever one person can complete an action alone. The defensible arrangement names roles: who may change a supplier bank record, who may approve a payment above an agreed value, who may authorise remote access to a workstation, who may reset a password. In a team of eight those roles land on the same two or three people, and the working part is that each action needs a second named person before it takes effect.

Bank detail changes deserve their own written rule because they carry the largest single losses. A change of account details is treated as a new supplier: confirmed by voice on the number from the contract, with a person whose name and role are written down, and the first payment held for a stated period. The record of who confirmed it and when is the part that matters six months later.

Access requests need the same shape in the opposite direction. Support sessions begin only from a ticket the employee raised, never from a call the employee received, and that single sentence removes most remote access fraud from a small company. Where an external provider genuinely supports the systems, the team agrees in advance how that provider will identify itself and which number it calls from. Providers unable to answer that question are saying something useful about their own security.

08

Writing the rule so it survives a bad afternoon

A policy running to nine pages gets read once during induction and never opened again. The working version fits on one side of paper and uses the words people actually say on the phone. It names the three triggers that make a call reportable, which are access, codes and money. It gives the single action of ending the call and dialling the stored number.

The refusal sentence belongs in the document, written out in full, so nobody has to invent wording while a stranger is talking. Something plain does the job: «I am going to ring you back on our own number, thank you.» Stopping there and hanging up is the entire technique. Employees who have a sentence ready use it, and employees who have to compose one under pressure keep talking.

The document also has to grant permission explicitly. It should state that ending a call from a genuine colleague, a genuine supplier or a genuine bank is an acceptable outcome and will never be counted as a mistake. Without that sentence the policy asks an employee to risk looking rude on their own authority, and most people decline that risk. The permission is the operative clause and the rest is detail.

09

Rehearsing until the refusal is boring

Reading a procedure creates recognition and nothing more. Practising it creates the habit that fires while adrenaline is running. A short drill twice a year is enough for a small team: someone rings a colleague, plays the part badly, and the colleague practises ending the call and dialling back.

The drill has to be announced and framed as practice for the procedure, with no scoring of individuals. Covert testing in a small organisation buys a statistic and costs trust, and a team that feels tricked by its own management reports less afterwards. The measure worth tracking is how many suspicious calls were reported, a figure that rises when people feel safe and falls when they feel examined.

New starters and reception deserve a specific version, because attackers ring the newest and the most helpful people first. Someone in their first week has no baseline for what is normal and every incentive to be accommodating. Ten minutes on day one covering who might ring, what will never be asked by phone and what to say instead is a better use of induction than most of what fills it.

10

After the call: the log, the bank and the absence of blame

Every call of this kind gets recorded somewhere durable, including the ones where nothing was given away. A few lines cover it: the time, the number shown, what was claimed, what was asked for and what happened. Three entries in a month from the same caller identification, or three entries naming the same supplier, reveal a campaign no single employee would have spotted.

Where something was given away, the clock matters more than the explanation. A code read aloud means the session is revoked and the password changed immediately. A payment sent means the bank is called within the hour, because recall depends on speed and stops being possible once the funds move onward.

The reporting culture decides whether any of this works. An employee expecting blame will wait, hope the problem resolves itself and mention it two days later when nothing can be recovered. A team that thanks the person who reports a mistake within the hour buys back the recovery window, which is worth more than the discipline it gives up. That balance is a management decision, taken long before the phone rings.