Pick a Family Password
A Parapup Tech Tip from Ramona
I know every human in this office by smell. Nobody gets past me pretending to be someone they’re not. On the phone, though, you don’t have a nose to rely on. AI can now copy someone’s voice from a short clip of them talking, the kind of clip that’s easy to find in a webinar, a podcast or a voicemail greeting. “It sounded exactly like her” isn’t proof anymore.
Training people to catch fakes is getting harder because the fakes keep getting better. So my tip doesn’t depend on catching anything. It works even when the fake is perfect.
The idea
Agree on a code word ahead of time with the people who can request or approve money and sensitive changes. When a request comes in, ask for the word. A real colleague knows it. An impostor doesn’t.
How to set it up
Decide who needs it. Start with anyone who can approve payments, wire transfers, payroll changes or vendor banking changes, plus the people who carry those requests out.
Pick a word in person. Choose something random that isn’t on social media. That rules out pet names (yes, even mine), street names and sports teams.
Never write it down where it can be stolen. Don’t send it by email, Teams or text. If an attacker is already in your inbox, they’ll find it.
Write down the rule, not the word. Add one line to your payment process: “Requests to move money or change banking details require the code word and a callback.”
When to ask for it
Ask for it any time a call, voicemail, text or email asks you to:
Send a wire transfer or make an urgent payment
Buy gift cards
Change a vendor’s or employee’s bank account details
Share login credentials or approve an MFA prompt
Be extra careful when the request is urgent, secret, or comes at a strange time. Pressure is the attacker’s favorite tool.
What to do if they don’t know it
Don’t argue and don’t explain. Say you’ll call back, hang up, and call the person on a number you already have on file. Don’t use the number in the message or the one that just called you. If the request was real, you’ve lost two minutes. If it wasn’t, you’ve saved a lot more.
Keep it fresh
Change the word whenever someone leaves the company, or if you think it’s been shared where it shouldn’t be. Bonus tip: set one up with your family too. The same scam works with a “grandkid” in trouble.
Want the bigger picture on why spotting phishing isn’t enough anymore? Read our post, Stop Training Your Employees to Spot Phishing. [Read the post →]
