The Voice Was Real Enough.

This summer, four of the biggest hedge funds on the planet got phone calls from people who said they weren't who they said.

The voices were straight and nobody lost a dollar.

Now, hold that thought.

A couple in Michigan got one phone call from a voice

that they trusted and it cost them sixty six thousand dollars.

What's good, Internet? This is your boy Q. And welcome to the Blast Radius.

His name is Quinn Vidal and Q is the alias.

Podcast launch and we call it the Blast Radius.

Every word perfect as applications in 86.

Fingers gripping keys.

Home row, stop taking risks.

Listen and level up your business's development.

Every episode, a new dose of your medicine.

Technical physician better come and see the specialist.

Nothing at all artificial about this intelligence.

All right. The blast.

Last month, CNN ran a story about a couple in West Michigan, Brian and Wendy.

They were buying a condo. They spent weeks of back and forth with the lender. You know,

normal stuff. The paperwork. They got a guy's name. They recognize his voice and they talked

to him a bunch of times. Now, a few days before closing, an email comes in. It looks like that

the lender. It has the right logo, right thread, everything, the tone, everything. And then the

phone rings, and the number on the screen is the same lender's number, the one that they had talked

to, the same phone, the same voice, the same guy, same cadence. He says, the closing funds need to

go now. Here's where.

So Brian wires $66,000.

Closing morning, the title company calls. Hey,

We're ready. Where's the money? The money's gone. It went days ago to somebody who was never

the lender.

So was this a deepfake?

Here's where I need y'all to slow down with me because the part

that everyone gets wrong and the purpose of this episode, CNN's headline said suspected voice

cloning. Suspected. The people who said this was AI, that's a company called CertIFID. They do

wire fraud prevention and they reviewed the case. They said the email looked authentic,

the number matched, and the caller sounded like the mortgage professional Brian already had

trusted. Now, I'm not saying that they're wrong. Spoofing a caller ID is a $10 trick and cloning

a voice off a guy that's been leaving voicemails and posting mortgage rates videos for them 10

years. Well, get to know how cheap that is. It's very plausible, but nobody proved it.

And here's the thing. Sit with this. It doesn't matter because look at what actually happened.

An email that looked right. A phone number that looked right. A voice that sounded right.

Every signal a normal human taught to check passed. And then a wire went out days before

closing on a phone call with nobody calling the lender back on the number they already had.

That's not an AI story.

That's there was no step story.

The voice could have been a clone.

The voice could have been a guy who's good at voices.

Same $66,000 either way.

Now, let me zoom out because this was a busy summer.

August 5th, Bloomberg reports that a coordinated voice phishing campaign against Citadel,

0.72, Two Sigma, Millennial, and a bunch of other private equity shops,

Callers were pretending to be colleagues, pretending to be IT, trying to

talk to employees into resetting passwords, handing over codes, opening the door.

And I want you to notice who they called, not the CFO, the help desk, whoever resets passwords.

That's the target. Now, a 12 person company has that exact same person.

It's just Dave. And Dave is also the guy who fixes the printer.

Two Sigma statement attempted.

No indication of any impact.

Point 72 told investors no client data taken.

Citadel and Millennial, no comment.

august 11 in spain police arrested a guy

who had been beating a certificate authority's video

id

check you know the thing where you hold up your id to the camera with forged id cards he had a

real-time face swap and I love this he used colored light bulbs from the hardware store to

fake the hologram shine 38 attempts 30 stolen

identities 320 phone lines he was getting real

digital signature certificates in other people's names. You know, the thing where you sign contracts

in an open account with.

How'd he get caught?

The face swap lagged for one second. His real face

popped up on the verification camera like a Zoom call on a hotel Wi-Fi and a person at the issuer

noticed.

Hong Kong, same window.

Police warn about 150 WhatsApp account hijackings in two weeks.

In one of them, scammers took over a father's account and sent his son voice notes, an AI voice

with his dad's sound. I need you to move money. It's urgent. Until the son has sent 10 million

Hong Kong dollars, about 1.3 million US, his entire savings. Notice, not even a live call,

video notes, the laziest deepfake in this episode and the most expensive. One more,

because it's the one that's coming for your company specifically.

July 31st, the State Department and the FBI plus 10 other governments,

Japan, the UK, Canada, Australia, Germany, on down the list,

put out a joint alert about a North Korean IT workers getting hired remotely

by Western companies on stolen identities, fake resumes, AI published.

a stand-in for the interview a laptop shipped to a laptop farm in the states so the login looks

local the FBI's own number for AI involved employment scams last year was almost 13 million

dollars and the FBI says the goal usually isn't

the paycheck it's access to your network the scam

doesn't want your money anymore it wants a job don't read the coverage on any of these here's

the pattern. One, AI gets asserted by somebody selling the fix or by the reporter and almost

never by the victim.

Two Sigma never said AI. 0.

72 never said AI.

CNN said suspected. When a

security company tells you a deepfake did it, ask who confirmed it. Two, they tell it like the deep

fake did the work. It didn't. Michigan started with a spoofed email. Hong Kong started with a

hijacked WhatsApp. The hedge fund started with a phone call to the help desk. The famous one in

ARP Hong Kong 2024, the finance guy on the video call with a fake CFO and fake colleagues about

$25 million.

15 transfers that started with a phishing email.

And the police said that the

video on the call was pre-recorded. They told him to introduce himself, and then he just listened.

Nobody faked a conversation.

They faked a meeting.

The deepfake didn't take $66,000.

A phone call with no callback did.

The deepfake is the last 10%.

Somebody opened the door first.

the voice just walked through it. Now, these are the numbers. Everyone's got a stat that ends in a

percent. deepfakes are up 3000 percent, up 1200 percent. Go find the source. It's a vendor's own

platform. Three years ago, no base number. Here's what the FBI actually counted. And this is the

first year that they even counted it.

Last year, just over a million complaints, $20. 9 billion

reported lost.

Of those, 22,000 mentioned AI, $893 million.

And the FBI says most victims never

realized that AI was involved. So that's the floor. But here's the number I want you to take

home.

$3 billion in business email compromised last year.

$30 million of it, AI. The other $3

billion didn't need it. That's the whole story. The scam that's actually emptying an account is

the boring one. The fake invoice. The changed bank details. The urgent wire. AI is a garnish on it.

A good garnish. But if you're building your defense around spotting the garnish, you're about

to find out why that doesn't work.

How far does this reach and what's changed?

Three things change

and I want to take them in order. What we know about people, what we know about the tech, and a

rule that quietly landed in June that most of y'all are already breaking. I know the instinct.

We'll do a training. We'll show everybody what a deepfake looks like. Here's the research. A meta

analysis, 56 studies, 86,000 people, everything from

photos to audio to video, humans correctly

call a deepfake 55% of the time.

The confidence interval crosses 50. That's a coin. And when they

train people, show them examples, gave them feedback, gave them the AI help, accuracy went

to about 65%.

10 points is still a coin flip with their certificate.

Audio is a little better than

video. It's not good. And the tools to get better every quarter, your people are not going to have

that training. So they don't. Okay. So we buy the software. Here's the problem with software.

Detectors score in the high nineties on the generators they were trained on. Now show them

generator they've never seen before. The next one, next month, they fall off a cliff on their

percentages.

Tens of points, some of them back to a coin flip.

Nobody puts this video is AI light

on Zoom or Teams or Meet. Zoom gets a verified human badge and beta that proves a person is

there.

Not that the video is real.

Teams added a report button, meet, nothing.

So here's where

you're left with. And it's the best news in the episode. Every single one of these that got caught

got caught the same way.

Ferrari in 2024, the CEO's voice cloned, accent and all, calling an

exec about a secret acquisition. The exec says, what's the book you recommended me last week?

Click.

Arup, 25 million out the door and got caught by a routine follow-up call with headquarters.

Spain, a person at the issuer watching the feed saw a one-second glitch.

WPP, the ad company,

fake WhatsApp, fake Teams meeting, voice cloner, the CEO, the exec on the other end just

got suspicious and stopped. Not a detector, not one of them. Every deepfake that got caught,

got caught the same way.

Somebody had a rule.

Now here's the part I promise, the regulatory shift.

And I checked this one hard because last episode I told y'all I was going to make claims about

regulation I couldn't source. This one I can. First, the bad news. As of this recording,

there is no law in this country that protects your business from somebody deep faking your CEO.

Not federal, not Texas, not New York, not California. The federal law that passed last

year called Take It Down is about intimate images. Real problem, not this problem. The one for voices

and likeness, no fakes, is sitting on the Senate calendar with no vote. The FTC has a rule against

impersonating a business. And since 2024, and that does give the FTC a stick that it doesn't

give you a takedown. And the part that rule would cover impersonating a person,

your CEO, it was proposed two and a half years ago, still not final. So nobody's coming. The

rule has to be yours. And here's the thing. One of them already is. Since June 19th, if your

business sends ACH payments, payroll through vendors, anything through bank rails, a rule

from Nacha, the people who run the ACH network say you are required to have risk-based procedures

to catch payments made under what they call false pretenses. And they define it,

someone misrepresenting who they are, someone misrepresenting that they are allowed to act

for someone else. Someone misrepresenting whose account the money's going to, they name it.

Business email compromise, vendor impersonation, and payroll impersonation. That's this, the Michigan

phone call. That's the fake vendor email, and it applies to every business that originates ACH,

and they took the size threshold off in June. Now, most of y'all have never heard the word

Nacha and your bank will not send you a memo. But the next time something goes wrong, we had

no procedure is now a worse answer than it was in May. All right. It's that time for us to talk

about what happened on the other side. You know, those stories that might have happened a few years

back. I'm at this tech company, not going to name it. One morning, everybody gets pulled into a Zoom,

all hands on deck. And if you've been in business a minute, you know that a hands on deck coming

is usually never good news. Here's what they tell us. Earlier that same morning, there had been

another Zoom scheduled call by one of the C-level executives, and the invite went to a few people

in HR and finance. Not everybody, just the people who can move money. On that call, there's the

exec on video, face, voice, the whole nine.

And the ask is, we owe a customer refund, a real customer,

one we actually do business with, and it needs to go out today, just to a different account.

It looked right. It sounded right. But a couple of things were a little bit off.

Sometimes you have that feeling, and this is what it was. And the folks on the call did the thing

they were supposed to. They didn't argue with the face on the screen. They stopped and checked

who they were actually talking to. Now, this didn't take long. It wasn't the exec. It was a

deepfake. It was a setup to walk money right out the door and nothing went out the door. Zero

dollars. So that second Zoom, the all hands on, that was the warning. That happened that morning.

This is what it looks like. This is what's happened. And this is what you should do.

And that's a place with a whole department for this. The small shop doesn't have the department,

but the department was never the part that worked. The part that worked was a couple of people

who felt something was off, and they were allowed to stop and check.

Looking back at Michigan one more time, what was the one signal in the story that couldn't be fake?

Not the email, spoofable. Not the caller ID, spoofable. Not the voice, clonable. For about

six bucks a month and a minute or two of audio off the guy's own website. The one thing the

scammer could not control was the number that Brian already had. If Brian hangs up and he dials

that number back, the real lender picks up. The whole thing dies in about 15 seconds. So the

defense can't be spot the fake. Same lesson as last episode, the message was perfect. The defense

has to be a thing that holds even when the voice is perfect. It's a phone number. You already own

it. The fix. Three things.

First one's free and you can do it before lunch.

Any new bank details,

any change bank details, any urgent transfer, one rule on paper that everybody who touches money

has to read.

New bank details. Hang up.

Call the number you already have, not the number in the

email, not the number that just called you, the number on the file. And two people sign off on

every change. Not because you don't trust your bookkeeper, because the scammer only needs one

of you to be having a bad day, to be off, to not catch the signs. That's the FBI's advice.

That's what the bank tells their own corporate clients. And as of June, written procedure,

Nacha expects you to have. Three sources, one index card. This one's straight from the FBI.

2024, word for word, create a secret word or phrase with your family to verify their identity.

Do it at home tonight, then do it at work tomorrow. Anybody calling, anybody, me included,

asking for money, access, who doesn't know the word is a stranger with your voice.

one honest caveat because I don't sell fairy tales a code word beats a voice clone it does not beat

a hijacked account if somebody's already inside dad's whatsapp they can read the word so the word

is layer two the callback is layer one this is the episode two fix again and I'm going to keep

saying until y'all do it the hedge fund callers wanted codes the help desk is the target because

that help desk can reset the thing that protects everything else. Phishing-resistant login,

pass keys where you can get them, text messages, codes off for anything that matters. If your IT

person says that's hard, CISA, C-I-S-A, the federal cyber agency, publishes the exact checklist

for Microsoft 365 and Google Workspace and a free script that grades your setup against it.

free. It's on the link in the description. And if you're hiring remote, verify the school

and the last job directly, not through the candidate. Get a face on a call and get somebody

in a room if you can. And if the paycheck's going to a bank account that isn't in the person's name,

stop. That's the State Department's list, not mine.

Fix three is module three.

Identity, passwords, MFA, and pass keys. It's live. It's free.

There's a quiz.

So fix one and fix two, the callback, the code word, the whole somebody had a rule thing.

That's the social engineering module.

And I'll be honest with you, it's not written yet. It's next.

The community votes on what's written and on the top of the vote, a full lesson within

side of a week.

So if you want it, go vote for it.

That's how this works.

So that's the radius on this one.

A voice that sounded right, a number that looked right, an email that looked right,

and $66,000 because there was no step where any of it had to be checked.

AI didn't beat the process.

There was no process.

You don't need a detector. You need a phone number that you already have and a rule that says you use it.

And the next episode is coming to you this week on Thursday.

We're talking about the robots. Open AI's own AI agents got out of their test lab and broke into another company.

Sounds like a movie. Here's the part that isn't. They didn't invent a new way in.

they used yours that's next. the lessons are in the community inside the Blast Radius on Skool

the foundation's track is free the link's in the description come tell me your callback story

somebody in there got caught one of these with a dumb question and I want to hear it

is your boy Q everything has a Blast Radius just find out how far yours goes and remember

pick a word. Peace.