Everyone's been sending me the deepfake CFO article. I'm not sure if it's real, so waiting for facts to emerge. But, here's what I'd do if it's accurately reported 🧵
amp.cnn.com/cnn/2024/02/04…
amp.cnn.com/cnn/2024/02/04…
Make sure you follow the four-eyes rule: Use access controls that require two (or more!) person approval for transfers above a risk threshold. Banks like @mercury and @meow make this easy.
Between certain staff (e.g., accountant -> CFO), it may make sense to share a secret passphrase to authenticate each other. If you want to get fancy, share a TOTP seed to reduce the risk further.
PROTIP: Use a generator to make a 16-character alphanum password. Bam, there's your seed.
Invites to the deepfake videocall probably didn't come from the correct addresses: it's still useful to consider mitigating phishing. Great services available from @material_sec, @sublime_sec, and @hoxhunt to pick a few.
Finally, don't give attackers any advantages for stealing valid accounts: require Security Keys for all logins (yes, for everyone). In 2024, it's time.
More: If large transactions are frequent and not out of the ordinary, make a separate process to more strongly authenticate new destinations, likely more rare.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
