NJ Small Businesses Lost $435M to Fraud in 2024

In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every other participant was a deepfake, including a convincing reproduction of a senior company officer. The employee authorized the transfer. The money was gone.

That attack required sophisticated video fabrication. Most do not. Voice cloning now requires just 20 to 30 seconds of audio, and executives post on LinkedIn, speak at conferences, and appear in company videos. That audio is publicly available. A fraudster clones the CEO's voice, calls the finance department, and requests an urgent wire transfer. The caller sounds exactly right. The urgency feels real.

The FBI's Internet Crime Complaint Center reported $16.6 billion in cybercrime losses across the U.S. in 2024, a 33% increase over 2023. New Jersey's $435 million is a state-level slice of that figure, and much of it came from exactly the kind of call Arup received: a convincing voice, an urgent request, and no mechanism to say "prove it."

Why Standard Defenses Fall Short

Spoofed phone numbers look legitimate. Spoofed email headers pass basic visual inspection. A caller who sounds like the CFO, calls from what appears to be the CFO's number, and references real internal project names has done their homework. The certified financial crimes specialist quoted in the NJBIZ piece "NJ small businesses face rising cybercrime, fraud risks," from Kearny Bank emphasized proactive employee training and internal controls. That framing is correct. The question is what those controls actually look like in practice for a ten-person finance team.

Knowing that an attack might happen does not give a finance team member anything to do when a convincing caller is on the line asking for an urgent $80,000 transfer to a new vendor account. The common advice is to hang up and call back using a number from your internal directory or the vendor's official website. That is sound, but a callback does not prove the original caller was legitimate: a fraudster who initiated the first call may have additional infrastructure in place. Always source your callback number independently from a company website, official invoice, or verified internal directory, never from a number the caller provided. If something still feels wrong, escalate internally before authorizing anything.

Judgment, under social pressure and time urgency, is not a reliable control.

What Verification Actually Requires

Effective internal controls for wire transfer authorization need three properties. They must work in real time, because fraud calls do not give you time to open a ticket. They must be out of band, because verifying through the same voice channel an attacker controls proves nothing. And they must be impossible to fake without inside access: a name, a title, and knowledge of internal projects can all be researched.

Trust Onion addresses this with three rotating codewords, calculated locally on each authorized device and refreshed every 60 seconds. When a caller claims to be the CFO authorizing a wire transfer, a vendor change, or any urgent payment, the finance team member asks one question: "What are the words?" If the caller cannot produce the current three words, nothing moves. The words are never transmitted over the network. A cloned voice cannot know them. An attacker who has spent months researching the company cannot guess them.

For teams that need to verify identity visually, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Verification checks the passkey signature against the full public key, the original photo's SHA-256 hash, and the signed record. It does not, by itself, guarantee the intended person was physically present.

New Jersey's $435 million in losses did not all come from sophisticated attacks on large enterprises. Much of it came from a convincing voice, an urgent request, and a finance team member who had no way to push back.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie™ photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie™ is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie™ private, or delete it at any time. Deleting a Proofie™ removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.