Reality Lab · 9 MIN · Judge
Verify a message that might be fake
An urgent voice note from your ‘manager’ asks you to move money fast. It sounds exactly like them. Design the check that a convincing fake can’t pass.
An accounts clerk gets a WhatsApp voice message that sounds unmistakably like their CFO: “Hi, I’m in a meeting and can’t talk — we need to wire €18,000 to a new supplier today or we lose the deal. I’ll email the details. Keep this between us for now, it’s sensitive.” The voice is right. The urgency and secrecy are doing the real work.
Your task: Write the verification routine you’d follow — one that doesn’t depend on whether the voice or the message ‘seems real,’ because convincing fakes are now cheap to make.
Voice note (sounds like the CFO): “Wire €18,000 to a new supplier today or we lose the deal. Details by email. Keep this between us — it’s sensitive.”
This box is local to your browser. Nothing you type is sent anywhere or saved after you leave.
Check your own work
There's no grade here — checking against these is the exercise. Compare each point to what you wrote.
- Verification happens on a separate, known channel you initiate — not by replying to the message.A faked voice or spoofed email controls the channel it arrived on. Calling the CFO back on their known number, or checking in person, is a check the attacker can’t sit in the middle of.
- The urgency and secrecy are treated as red flags, not reasons to move faster.‘Now, and don’t tell anyone’ is the signature of the scam — it exists precisely to stop you doing the verification. The pressure is the attack.
- You don’t treat ‘it sounds just like them’ as evidence.Cloning a voice from a few seconds of audio is cheap and convincing. Recognising the voice tells you nothing about who actually sent it.
- There’s a standing rule for payments — dual approval or a callback — so this doesn’t rest on one person’s judgment.Individual vigilance fails under pressure. A policy that any new-supplier payment needs a second approver on a known channel turns a personal gut-check into a control that holds every time.
Reveal a worked approach
A routine that holds: “I don’t act on the voice note or the email. I call the CFO on the number I already have — not one from the message — and confirm in person or by that call. I say out loud that I can’t bypass the two-approver rule for a new-supplier payment, however urgent. If I can’t reach them, the payment waits; a real deal survives a phone call, a scam rarely does.”
Notice what carried the safety: not an ability to detect the fake, but a process that doesn’t rely on detection. The independent callback and the dual-approval rule work whether or not the voice was real.
The habit to carry: as synthetic voices, video, and text get better, ‘does it seem genuine?’ stops being a usable test. Verify identity and authority through a channel you chose, and let policy — not adrenaline — decide.