The CEO Who Never Called

The following is a lightly anonymised account of a real engagement. Identifiers have been altered. Technical findings are presented as they occurred. We are publishing it because voice cloning has crossed from research curiosity to a commodity criminal tool, and because the controls that stop it are not technical. They are procedural, and they are old.

The Engagement

At 15:52 on a Thursday, the company's financial controller, Helen, received a call on her desk phone. Caller ID showed the CEO's mobile number. The CEO, Dominic, was travelling to a trade show in Germany, and Helen knew this. The voice on the line was Dominic's. It was warm, slightly rushed, and apologetic.

He explained that an acquisition they had been quietly negotiating needed a deposit wired before close of business European time or the deal would collapse. He gave her a beneficiary name and a bank in Lithuania. He said the lawyers would send the paperwork tomorrow. He said, 'I know this is irregular, Helen, and I wouldn't ask if it wasn't important.'

Helen had a procedure for this. The procedure was a callback to the CEO's mobile. She called it. Dominic answered on the second ring, in the same voice, and confirmed. She released the wire: $1,140,000 CAD.

The following morning the real Dominic, in Hamburg, read her confirmation email and called the CFO. We were engaged by noon.

Finding 01: The Calls: Telecom and VoIP Records

# SIP From header spoofed; carrier CDR shows the callback was unconditionally forwarded to a Lithuanian mobile
# PBX SIP log - inbound call to Helen's extension (Asterisk full log, condensed)
grep -A6 'INVITE sip:2217@' /var/log/asterisk/full | grep -E 'From|P-Asserted|Via|Contact'

# [15:52:04] From: "Dominic ████" <sip:+1416████████@sip.trunk-provider.com>   ← CEO mobile as caller ID
# [15:52:04] P-Asserted-Identity: <sip:+1416████████@sip.trunk-provider.com>
# [15:52:04] Via: SIP/2.0/UDP 185.53.██.██:5060;branch=z9hG4bK...        ← NOT the carrier's Canadian POP
# [15:52:04] Contact: <sip:anon@185.53.██.██:5060>

# 185.53.xx.xx → Dutch VoIP wholesaler (ASN AS2████). Caller ID is an unverified attribute on this trunk.
# STIR/SHAKEN attestation header: ABSENT. The SIP trunk provider does not sign inbound international calls.

# Carrier CDR - Helen's OUTBOUND callback to CEO mobile at 15:58:41
# Dialed:        +1416████████  (CEO mobile)
# Terminated at: +370 6██ ████ (Lithuania, mobile)   ← CALL FORWARDED
# Forward reason: 'Unconditional Call Forward' active on CEO's number since 15:31 same day
# Duration: 00:01:47

The inbound call had been placed through a European VoIP wholesaler with Dominic's mobile number set as the caller ID, a field that costs nothing to populate and that the Canadian trunk provider did not validate. That part was expected.

The callback was the part that mattered. Helen's outbound call to Dominic's real mobile number had terminated in Lithuania, because unconditional call forwarding had been activated on his line 21 minutes before the first call.

Finding 02: How the Forward Was Set: The Carrier Account

# Carrier support social-engineered with OSINT security answers; forward active for 101 minutes
# Carrier account change log (produced under legal request) - CEO's mobile line
# Timestamp (ET)      Channel         Change                                       Auth method                Agent
# 2024-██-██ 15:29    Phone support   Account PIN reset                            Security Qs (3/3 correct)  ████
# 2024-██-██ 15:31    Phone support   Call Forward Unconditional → +370 6██ ████   Account PIN                ████
# 2024-██-██ 17:12    Phone support   Call Forward Unconditional → OFF             Account PIN                ████

# Security questions on file: mother's maiden name, first car, city of birth
# All three answerable from: CEO's public LinkedIn, a 2019 podcast interview, a local newspaper profile of his mother
# Support call recording: caller spoke with an accent the agent described as 'maybe Dutch or German'; agent did not escalate

# Forward was switched OFF at 17:12 - after the wire confirmation.
# The CEO's phone missed calls for 101 minutes and he noticed nothing.

Nothing on Dominic's handset would ever have told him. Call forwarding lives in the carrier's network, not on the phone. His outbound calls, data, and messaging continued to work. For 101 minutes, every call to his number rang in Lithuania instead, and the attacker switched the forward off once the wire confirmation had landed.

Finding 03: The Voice: Spectral and Synthesis Analysis

# Flat pitch variance, missing breath events, band-limited HF energy; idiolect mismatches flagged by colleagues
# Spectral comparison - call recording vs genuine CEO corpus (librosa / numpy, condensed)
import librosa, numpy as np

call, sr = librosa.load('ext2217_155204.wav', sr=8000)
ref,  _  = librosa.load('ceo_townhall_2023_8k.wav', sr=8000)

def stats(y):
    f0 = librosa.yin(y, fmin=70, fmax=300, sr=8000)
    f0 = f0[np.isfinite(f0)]
    return dict(f0_mean=f0.mean(), f0_std=f0.std(),
                hf_ratio=(np.abs(librosa.stft(y))[200:,:].sum()/np.abs(librosa.stft(y)).sum()))
print('CALL:', stats(call))
print('REF :', stats(ref))

# CALL: {'f0_mean': 118.4, 'f0_std': 6.1,  'hf_ratio': 0.012}
# REF : {'f0_mean': 121.9, 'f0_std': 19.7, 'hf_ratio': 0.041}

# Pitch variance in the call is ~1/3 of the real speaker's - flat, 'read' prosody
# High-frequency energy (>3.2 kHz) is a quarter of the reference even at matched 8 kHz - synthesis band-limiting
# Breath events detected in reference: 41 in 4 min. In call: 2. Humans breathe.

# Phrase-level anomaly flagged by three staff independently:
#   Synthetic voice closes with 'Great, thanks.' - Dominic says 'Cheers' or 'Appreciate it', never 'thanks'
#   Pronunciation of 'Lithuania' - synthetic voice stresses the second syllable; Dominic (Scottish) stresses the third

# Source material match: 14-minute Q3 investor webcast (public, YouTube)
# Phoneme coverage sufficient for a commodity cloning service

The spectral signals pointed clearly to synthesis: pitch variance a third of the real speaker's, almost no breath events across four minutes of speech, and high-frequency energy consistent with a vocoder output rather than a telephone-band human voice.

But the most persuasive evidence for the people in the room was linguistic. Three colleagues, listening independently, said the same thing: Dominic does not say 'great, thanks.' He has never once said 'great, thanks.'

Finding 04: Pretext Construction: What the Attacker Knew

# No mailbox compromise - pretext assembled from a sell-side teaser list and a LinkedIn post
# M365 UAL - any foreign-IP access to CEO or EA mailboxes, 90 days?
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
  -Operations MailItemsAccessed,UserLoggedIn -UserIds dominic.████@co.com,ea.████@co.com -ResultSize 5000 |
  % { ($_.AuditData|ConvertFrom-Json).ClientIPAddress } | Sort -Unique
# Result: corporate egress, CEO home, EA home, two hotel IPs matching travel dates. Nothing foreign. No compromise.

# So where did the acquisition leak?
# Sell-side advisor's deal teaser (not under NDA until data room) was emailed to 212 recipients.
# One recipient domain: a PE 'firm' registered 6 weeks earlier with a Lithuanian director.
# Teaser named our client as the acquirer.
# Travel: CEO posted 'Hamburg-bound for ████ Messe' on LinkedIn 2 days prior.
# Time zone and unavailability handed to the attacker.

An accurate pretext usually prompts people to assume the mailbox was compromised. Here it had not been. The attacker needed only two things: a deal teaser that a sell-side advisor had sent to 212 recipients before any NDA was in place, and a LinkedIn post announcing the CEO's trip. One of the 212 recipients was a shell entity created for the purpose. Nothing in the client's tenant was touched.

Reconstructed Timeline

How Each Control Was Defeated

Every control in place on the day did what it was designed to do. Each one rested on an assumption the attacker had already removed.

Lessons for Incident Responders

1. 01
   Pull carrier CDRs for both legs immediately. The PBX will show you the spoofed inbound; only the carrier's outbound CDR shows where a callback actually terminated. A callback that 'worked' is not a callback that reached the right person.
2. 02
   Treat the compliance call recording as primary evidence. Spectral features (pitch variance, breath events, HF energy) are strong signals, but corroborate them with people who know the speaker. Idiolect is the thing cloning models learn last.
3. 03
   Do not assume mailbox compromise because the pretext was accurate. Check the UAL, then go hunting for the leak outside the tenant. Advisor distribution lists and public social posts are the usual suspects.
4. 04
   Request the carrier's account change history on day one and preserve the support call recording. The social engineering of the carrier is often the most prosecutable act in the chain.

Lessons for Finance Leadership & Security Engineers

1. 01
   A callback is only a control if it cannot be redirected. Pair it with a second channel the attacker cannot forward: a pre-agreed verbal passphrase, a message to a second executive, or a video call. Voice alone no longer authenticates anyone.
2. 02
   Put a carrier account PIN and a port/forward lock on every executive mobile line. Replace knowledge-based security questions with something that cannot be derived from a podcast.
3. 03
   Executives should assume everything they have said on a public recording is training data. That is not a reason to stop speaking publicly. It is a reason to stop treating a familiar voice as proof of identity.
4. 04
   Dual authorisation for any wire over a threshold, with the second approver reached independently, is older than the internet and would have stopped this. Deepfakes are new. The control is not.