MODULE 4 · LESSON 2
Free — no login requiredSign in to track progress, save quiz attempts and enrol in the full course.
Sign in to track progress / enrolThe Four Part Skeleton
Nearly every manipulation attempt, however it arrives and however polished it is, needs four things. They are not stylistic choices. They are structural requirements imposed by what the attacker is trying to achieve, which is why they survive perfect imitation.
Authority
Someone you would not ordinarily question. A director, the finance lead, IT support, a regulator, a major client, a lawyer.
Authority does two jobs at once. It supplies a plausible reason for an unusual request, and it raises the social cost of pushing back. Most people are more reluctant to challenge a senior figure than to challenge a peer, and attackers select their impersonation target with that reluctance in mind.
The correction: authority is a claim, not a fact. In a world where a face and voice can be synthesised, seniority raises the required standard of verification rather than lowering it. The more senior the apparent sender, the more warranted the check.
Urgency
A deadline that removes the time to think or consult. Before close of business, within the hour, the deal collapses at five, the account will be suspended today.
Urgency is the engine of the whole thing. It is what prevents the target from doing the one thing that would end the attack, which is pausing to confirm. A person under time pressure defaults to compliance, and attackers manufacture that pressure deliberately.
The correction: legitimate business almost never collapses because somebody took ten minutes to verify. If it genuinely would, that is a process problem in your organisation worth fixing on its own merits. Treat urgency as the tell rather than as a reason to hurry.
Isolation
A reason not to involve anyone else. Confidential until announced, do not discuss internally, keep this between us, disclosure rules prevent wider circulation.
This is the strongest single signal in the entire skeleton, and it deserves specific attention because it is the one people most often rationalise away.
Notice what it does. It pre emptively disables the exact control that would defeat the attack, which is you mentioning it to a colleague. The attacker is not merely requesting discretion, they are removing your defences, and they are doing it in a way that sounds like a legitimate business constraint.
The correction: genuine confidential work does not require you to conceal it from your own manager or your own finance team. Real acquisitions and real legal matters have processes, and those processes involve more than one person by design. A request that isolates you is doing so for the attacker's benefit, not the business's.
An irreversible action
Something that cannot be undone. A payment, a credential, an authentication code, an approval, a change to bank details, a file sent outside the organisation.
Attackers need irreversibility because reversible actions do not pay. This is why the request is almost never something you could simply retract tomorrow.
The correction: match the strength of your verification to how permanent the action is. Reversible things need little. Irreversible things need an independent channel every time, regardless of who is asking or how certain you feel.
Scoring a request
Run the four against anything that feels slightly off, and against everything involving money or credentials regardless of how it feels.
The Arup case scores four out of four. The CFO supplies authority. The transaction is urgent. It is explicitly confidential and not to be discussed. A wire transfer is maximally irreversible. The deepfake was only the delivery mechanism; the skeleton underneath was ordinary and entirely visible.
That is the encouraging part of this lesson. The most technically sophisticated fraud in this course was, structurally, a completely standard attack.
Applying it to voice and video
The skeleton is medium independent, and this is what makes it durable.
When a request arrives by phone in a familiar voice, or on a video call showing a familiar face, the synthesis addresses only one question: is this person who they appear to be? It says nothing at all about the other four.
So ask them anyway. Is this person claiming authority I would not normally question? Is there manufactured time pressure? Am I being discouraged from involving anyone? Is the action irreversible?
A perfect deepfake asking you to do something urgent, secret and irreversible is still asking you to do something urgent, secret and irreversible. The imitation quality is irrelevant to all four questions, which is precisely why this is the check worth training.
Of the four, secrecy deserves disproportionate attention, for a reason worth making explicit.
The other three have common legitimate versions. Senior people do make requests. Genuine deadlines exist. Irreversible actions are a normal part of business, and finance teams perform them daily. Each of the three generates real false positives, so treating any of them alone as proof would make you unable to work.
Enforced secrecy is different, because its legitimate versions are far rarer and they look different in a specific way.
Real confidentiality restricts a circle. It says this must not leave the deal team, or this is restricted to those named in the agreement. It defines a boundary that includes several people, and it is normally established in advance, through a process, rather than arriving inside the request it applies to.
Fraudulent secrecy isolates an individual, and arrives with the request. Keep this between us. Do not raise it internally. Do not mention it on the group channel. The circle it defines has exactly one person in it, and that person is the one being asked to act.
The test is therefore simple and quite reliable: does this confidentiality requirement include anyone other than me? A real restriction has a boundary with several people inside it. A fraudulent one has a boundary drawn around you alone.
There is an organisational implication as well. If your culture makes people feel they cannot ask a colleague to sanity check an unusual instruction from a senior figure, you have manufactured the isolation condition for free, and an attacker no longer needs to supply it. Cultures where checking is normal and unremarkable are materially harder to attack, which is a genuine security control that costs nothing to implement.
Which single element of the skeleton should be weighted most heavily, and why?
Authority
Click to flipImpersonating someone the target would not normally question. Supplies a reason for the unusual request and raises the social cost of pushing back.
Click to flip backEvery manipulation attempt needs authority, urgency, isolation and an irreversible action, because these are structural requirements rather than stylistic choices, and imitation quality cannot remove them. Weight isolation most heavily: real confidentiality restricts a circle of people and is established in advance, while fraudulent confidentiality isolates you alone and arrives inside the request. The skeleton works identically on a phone call or a video call, because a perfect deepfake making an urgent secret irreversible request is still making an urgent secret irreversible request.