News for hackers. Stuff that matters.

A comment on Finance worker pays out $25M after VC with deepfake CFO. Parent comment

Re:Finance worker pays out $25M after VC with deepfake CFO by doubloon on Sunday February 04, 2024 @10:17AM (#39250813)
every process has exceptions. and there is no process stronger than the manager firing an employee for disobeying an order.
[ Parent | on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO by cj on Sunday February 04, 2024 @10:28AM (#39250936)
> every process has exceptions

Except these sort of transfers almost always happen with, at a minimum, dual approval where exceptions cannot be made because it's software defining the rule.

1 employee submits the transaction for review, and a 2nd (and sometimes a 3rd, 4th) person must approve it before the payment initiates. There isn't typically a bypass function.

Also, CFOs are typically responsible for setting up and enforcing these controls. A big part of a CFO's job is to manage risk. If you work under a CFO, you would be more likely to be rewarded for following the process than be punished.

Obviously there are exceptions to this, but by and large no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud.

[ Parent | on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO by MichaelZuo on Sunday February 04, 2024 @10:39AM (#39251055)
Not if the CFO and the other most senior executives all order you to do so on a video call… hence the article.
[ Parent | on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO by cj on Sunday February 04, 2024 @02:59PM (#39253781)
When I say “no CFO” would punish someone doing things that mitigate fraud… it’s the same as saying “no software engineer intentionally introduces bugs on purpose”.

Obviously the statement isn’t literally accurate. Hopefully it’s 99% accurate (otherwise none of us would have jobs if all we did all day was sabotage our employers). Likewise, not every CFO is to be trusted, nor are all software engineers… but most can be.

[ Parent | on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO by mvc on Monday February 05, 2024 @06:42AM (#39260140)
I think there's a lot of people here making the wrong assumption about how their CFO would react to being told no.

These people aren't stupid. I'd expect them to understand risk better than your average senior software engineer and if you tell them "Sorry boss, too risky to do that right now. I can't be 100% sure this message is genuine. Let's sync on this after your meeting", your chances of promotion at this company would likely rise, not fall.

[ Parent | on HN ]
Re:Finance worker pays out $25M after VC with deepfake CFO by mcv on Monday February 05, 2024 @10:55AM (#39262471)
Chalk that up as another reason why employers shouldn't be able to fire people too easily.
[ Parent | on HN ]