This post has two threats, and they’re connected by the same weakness: both get past us because we trust what we recognize.
Ransomware is an outcome, not a separate attack
Ransomware locks your files and demands payment to unlock them, often threatening to publish what it took. It sounds like its own category of threat. It isn’t, really. It’s what happens at the end of the attacks this series has already covered.
It arrives through the same doors: a reused password from a breached site, a system that never got updated, an attachment someone opened on a busy Tuesday, an account without multifactor authentication. By the time the files lock, the important part happened days or weeks earlier.
That’s good news, in a way. The defenses are the ones you already know: unique passwords and a password manager, multifactor authentication, updates that actually install, and backups you’ve actually tested.
Why it hits nonprofits differently
When a business is hit, it loses revenue. When a service organization is hit, it loses the ability to serve people who were counting on it that week: the family expecting a food delivery, the client with an appointment, the volunteer schedule that lives in a system nobody can open.
That’s why the next post asks a blunt question about running without systems.
Cloned voices
Cloning a voice no longer takes much. A short recording of someone speaking is enough, and most executive directors have plenty of audio online already: a recorded webinar, a conference panel, a video on their own website, a podcast interview.
So the phone call that sounds exactly like your ED, asking for an urgent wire before a deadline, may not be your ED. Video is following the same path. A face on a video call is becoming less reliable as proof of who someone is.
The oldest verification method we have, “I recognized her voice,” no longer counts as evidence.
The defense isn’t technical
That’s the good news here, too. The defense is the callback rule from earlier this month, extended to cover voice and video:
- Payment approvals don’t happen on a call. Not by voice, and not on video, no matter how familiar the person sounds.
- Verification happens out-of-band, on a number you already had, never one given to you in the call or message.
- Agree on a code phrase, if that’s easier for your team than a callback. Something a cloned voice wouldn’t know, and that never appears in email or online.
If your verification rule only mentions email, it has a hole in it now.
Talk about it before it happens
The executive director and the person who handles payments should have one short conversation: “If you ever get a call from me asking for money to move urgently, here’s what you do.” Having that conversation in advance makes it much easier to hang up and call back when the moment comes.
This week’s action
Check that your payment verification rule covers voice and video, not just email. If it doesn’t, add the words today.
Next in this section: could you run a week without systems?