A familiar voice is no longer a control

For most of the history of this business, a familiar voice on the phone was itself a control.

You knew your sellers. You knew your bank contacts. If something about a payoff felt wrong, you picked up the phone, and the voice on the other end either sounded right or it didn't. That instinct was real, and for decades it was mostly enough.

It isn't anymore, and the reason is boring: the cost collapsed. Cloning a voice takes minutes. Spoofing a caller ID takes less. The pressure scripts — urgency, authority, a plausible reason you can't call back — are rehearsed and reused. The person on the other end of the line no longer has to be good at this. They just have to be running a playbook that already works.

One afternoon in November

On November 17, 2025, someone called Escrow Technologies, Inc., a licensed California escrow company, claiming to be City National Bank's fraud department.

By the end of it, employees had authorized 40 wire transfers to 11 financial institutions. Thirty-five processed. Five were rejected. The DFPI's Notice and Summary of Findings puts the total transferred out at $4,281,686 and the estimated trust shortage at $3,804,686 — the largest confirmed outside wire fraud loss for a California escrow company. The source document is public on dfpi.ca.gov.

I want to be careful about how I say this next part, because the easy version is wrong. This was not a careless office. Careless offices miss reconciliations; this office was persuaded. Social engineering doesn't attack the procedure — it attacks the person, in the moment, with a story built to make compliance feel like the safe choice. "The fraud department is on the line" is a sentence engineered to make you skip your own process, because skipping it feels like cooperating with the process.

Anyone who says their office would never take that call has not thought hard enough about what a good version of that call sounds like.

The part the office controls

You do not control whether someone tries. Someone will try. The playbook is cheap, your office handles large sums on deadlines, and the phone number is on your website.

What the office controls is what its review looks like — and whether the file shows it. When an instruction changes, there is a set of questions every careful office already asks: What changed? What did we check it against? Which source did we use — the number on the office file, or the number the caller gave us? What's still open? Who reviewed it? What did we decide?

The gap I keep seeing is not that offices skip these questions. It's that the answers live in someone's head, or in a call that nobody logged, or in a hallway conversation between the officer and the manager. The review happens; the record doesn't.

Six months later

Every bad wire produces the same scene, months after the fact. The adjuster asks what you checked. The lawyer asks what you checked. The state examiner asks what you checked. They are not asking whether you are a careful person. They are asking what the file shows.

Either the file has the answer or it doesn't. A callback to the number on the office file, logged with a note reference. A payoff demand compared against a dated source. An item marked open because it was open. A named reviewer and a time. That page is cheap to write at the moment of review and nearly impossible to reconstruct honestly afterward.

The office that has it is in a different conversation than the office that doesn't — with the adjuster, with the examiner, and with itself.

What Veto does with this

Veto records the wire review your office already runs and files that one page before the money moves. It doesn't screen calls, and it doesn't stop anyone from being persuaded — nothing does, reliably. It makes the review visible in the file, at the time it happened, including what stayed open. The office decides. Veto records the review.

— Sebastian Heyneman