In October 2024, dozens of employees at the cloud security company Wiz received a voice message that sounded like their chief executive, Assaf Rappaport, and was designed to collect their login credentials. The voice had been cloned from a conference talk, and the attack failed for a reason no detection product would have flagged: Rappaport has public speaking anxiety, so the voice he uses on stage is not the one his staff hear every day. That detail exposes a trade-off communications teams rarely discuss, because the interviews, expert columns and podcast appearances at the center of a cybersecurity PR program, like the one described here, also leave behind clean recordings of the people a company most needs others to trust. The impersonation attempts documented since 2024, from Ferrari to the private banking arm of Italy's largest lender, show which defenses hold when a familiar voice asks for money or access. The ones that worked had less to do with judging audio quality than with knowing the real person and the real process.
Three Seconds of Audio and a Checkbox
Cloning a voice stopped being difficult some time ago. In 2023, McAfee researchers reported that a free tool produced an estimated 85 percent voice match from about three seconds of audio, and roughly 95 percent once they trained it on more material. That same year, a University College London team played genuine and synthetic speech to 529 people, who identified the fakes 73 percent of the time. Training lifted their scores only slightly, and the researchers pointed out that their samples came from relatively old algorithms. Consent checks have not closed the gap either: when Consumer Reports examined six popular cloning services in early 2025, four of them relied on users ticking a box to confirm they had the right to copy a voice.
Supply takes care of the rest. Quarterly earnings calls alone give the chief executive of a listed company a public archive of clean, clearly labelled audio that grows every three months, and that is before anyone counts keynotes, panels, podcasts and television interviews. Security vendors are more exposed than most, because their executives and researchers are expected to explain threats in public, and that visibility is part of how they win business. Coverage of an April 2024 attempt against LastPass pointed to public recordings of its CEO, including a YouTube video, as the likely source material. In a separate attempt reported in May 2024, fraudsters targeting WPP combined a voice clone with YouTube footage of its then chief executive, Mark Read, and a publicly available photo. None of them needed to break into anything.
What Stopped the Attempts That Failed
The failed attacks look alike once you line them up. At LastPass, an employee received a series of calls, texts and at least one voicemail on WhatsApp from someone posing as the company's CEO, Karim Toubba. The voice was not what gave it away. WhatsApp was not a channel the company used for business, the messages leaned hard on urgency, and the employee took them to the security team instead of answering. LastPass then published an account of the attempt, which turned a near miss into a public warning.
Ferrari's version, reported by Bloomberg in July 2024, opened the same way: WhatsApp messages from an unfamiliar number, a profile picture of CEO Benedetto Vigna in front of the prancing horse, and talk of a large, confidential acquisition. A call followed in a convincing copy of Vigna's southern Italian accent, asking for help with a currency hedge transaction. The executive on the other end noticed faint mechanical tones, said "Sorry, Benedetto, but I need to identify you," and asked for the title of a book Vigna had recommended to him a few days earlier. The line went dead.
The Wiz employees belong in the same column. They did not catch the clone through any skill in audio forensics. They caught it because they knew how their CEO sounds when he is not on a stage. Each of these defenses rested on something an attacker cannot scrape from the internet: a private conversation, a normal channel, an everyday voice.
How the Successful Attacks Got Through
The attacks that worked brought their own confirmation. Early in 2024, a finance employee in Arup's Hong Kong office received a message, supposedly from the firm's chief financial officer, about a confidential transaction. He suspected phishing. Then he joined a video call in which the CFO and several colleagues appeared and spoke, and his doubts faded because they looked and sounded like people he knew. Every one of them was generated. He made 15 transfers to five Hong Kong bank accounts, HK25.6 million in total, and the fraud surfaced only when he later checked with head office.
In early 2025, a cloned voice of Italy's defense minister, Guido Crosetto, phoned some of the country's best-known business owners and asked for help paying ransoms for Italian journalists supposedly held in the Middle East. The story was timed to land weeks after a real Italian journalist had been freed from detention in Iran. The only target publicly confirmed to have paid, former Inter Milan owner Massimo Moratti, wired nearly €1 million, which investigators later froze in a Dutch bank account.
The most recent and largest of these cases became public in September 2026. According to Reuters, the chairman of Fideuram, the private banking arm of Intesa Sanpaolo, received a WhatsApp message in February that appeared to come from the group's chief executive, pressing for transfers to secure a deal abroad. A phone call followed from what sounded like a senior partner at an international law firm, a lawyer the chairman knew personally and who, it turned out, had nothing to do with any of it. His voice had been cloned. Backed by forged paperwork that included a confidentiality agreement and a power of attorney that appeared to carry the CEO's signature, the scheme moved about €95 million abroad, mostly to accounts in China and Hong Kong. Cooperation between authorities in China, Portugal and Italy recovered roughly €53 million, while about €36 million had been converted into cryptocurrency and was still missing. The voice that carried the fraud was the one meant to verify it.
Set side by side, the successful cases share a structure: a request from the top, a deadline and a demand for secrecy. The two largest added a second voice or face that seemed to confirm the first, which means verification did take place. It simply took place inside the attacker's script.
Verification That Does Not Depend on the Ear
Teaching staff to hear the difference will not carry much weight on its own, and confidence can make matters worse. A Censuswide survey of 500 office workers in Singapore, published by KnowBe4 in October 2026, found that senior managers were the group most certain they could identify a fake message, at 78 percent. They were also the group most likely to act on a cloned CEO voice before verifying it: 35 percent, against 16 percent of clerical staff. Half of all respondents said they would feel uncomfortable challenging a request from a senior executive. Controls that hold up have to work no matter how convincing the voice is or how senior the person listening:
- Take authority away from the voice. A payment, a credential reset or a confidential instruction should never be valid because of who it sounds like, only because it came through a channel the company registered in advance. Most of the cases above began on WhatsApp or from an unfamiliar number.
- Confirm through a route the requester did not supply. Call back on a number from the internal directory, or require a second named approver who was not part of the conversation. At both Arup and Fideuram, the scheme came apart only after someone outside the attacker's script got involved.
- Ask about shared context, not static secrets. Ferrari's question worked because the answer existed only in a private conversation from a few days earlier. Details that can be researched, from birthplaces to career histories, give no protection against an attacker who has studied the target.
- Make the right to verify a written rule. Executives should state in writing, and repeat in person, that they expect to be checked and will never penalize a delay caused by checking. The rule has to bind senior staff as well, since the Singapore data suggests they are the likeliest to skip it.
- Share the media calendar with security and finance. Every keynote, podcast or broadcast interview adds fresh audio and often a plausible pretext, so periods of heavy visibility, such as deal announcements and earnings season, should come with a reminder to staff about payment rules. The Crosetto calls were built around a story that was already in the news.
- Publish the rules and the attempts. Tell partners and customers which channels the company uses and what it will never ask for, and disclose failed attempts the way LastPass did in a blog post and Wiz's chief executive did from a conference stage. Every public account makes the same script harder to run against the next target.
None of this requires executives to go quiet. Withdrawing from public view would cost a company the credibility that visibility builds, and the recordings already online would not disappear. The realistic aim is to make a leader's voice worthless as a credential while it remains valuable as a reputation.
A familiar voice used to be reasonable evidence of identity, and for anyone with a public profile it no longer is. The organizations that came through these attempts intact had already decided that sounding like the boss authorizes nothing. Where money was lost, that decision had been left to whoever happened to answer the call.
