Financial Services Cybersecurity Solutions & Training

In early 2020, a branch manager took a call from a company director he had spoken with before. The director said his company was about to make an acquisition and needed transfers authorized. Emails from the director and from a lawyer said to be coordinating the deal arrived to support the request, and the manager authorized transfers totaling US$35 million.

The director's voice had been cloned. Dubai investigators who led the case found that the scheme used "deep voice" technology, involved at least 17 people, and scattered the money across bank accounts around the world. UAE authorities later asked their US counterparts for help tracing funds that had moved into American accounts.

Everything the manager heard and read pointed the same way. A voice he recognized, a deal that sounded like the kind his client would make, and written confirmation from a lawyer he had no reason to doubt: three sources that appeared independent, all built by the same hand. When evidence seems to corroborate itself, people stop looking for a fourth source.

The pretext did the rest. A confidential acquisition is a legitimate reason to keep a request quiet, so the natural instinct to mention it to a colleague was switched off by the story itself. Trust earned over earlier conversations was spent in a single afternoon, and the one habit that would have broken the spell, a call back on a number already on file, never felt necessary.

A familiar voice is no longer proof of identity, and staff who approve payments need to know that before the call comes. Codex includes deepfake awareness and business email compromise modules, built around the urgency, authority, and confidentiality that this scheme relied on, in Arabic and English.

The email half of the attack can be rehearsed. Whitebait and Blackbait can run scenarios built on a confidential acquisition, an outside lawyer, and a request to move money quickly, and show which approvers act on them. Blackbait's OSINT reconnaissance also shows how much public material exists about the executives an attacker would impersonate.

Odin weights payment approvers and relationship managers by role criticality. When their simulation results or training gaps push them past a critical threshold, the right stakeholders are notified automatically, and every intervention is logged for audit. For banks that keep data in-country, Fraus can run fully on-premise.