Accounting Firms Can't Skimp on Cybersecurity

Early in 2024, attackers used deepfake video and audio to impersonate senior executives during a routine video call with an employee at UK engineering firm Arup, resulting in the theft of $25 million. The article warns that accounting teams are especially at risk due to SaaS sprawl, reused credentials, insecure communications (email/SMS), and limited identity controls at smaller firms, and it recommends baseline technical controls (MFA, VPN, encryption, MDM), secure client portals, least-privilege access, and regular security awareness and out-of-band verification practices to mitigate such social-engineering and impersonation attacks.