The confirmation request looks right. How do you know it is?

A confirmation request lands in your inbox. Right firm name. Right tone. Right terminology. Your team has answered a hundred like it. 

Here’s what’s changed. Attackers no longer send the clumsy, typo-filled emails you’ve been trained to spot. They use AI to write messages that sound like your audit partners, and to clone the voices of the people who authorize requests. Your bank has probably invested heavily in protecting its perimeter. The exchange with an outside auditor is where customer data steps past it. 

None of this is new. When Wirecard collapsed in 2020, auditors found that €1.9 billion supposedly held at Asian banks didn’t exist. The verification had leaned on third-party trustees and paper and email chains that were easy to manipulate. 

The fix isn’t asking your team to get better at spotting fakes. It’s making sure they don’t have to.  

The Currency of Trust: Securing the Audit Confirmation Process lays out where the risks sit today and why providing a secure process for your clients and their auditors is essential to your bottom line. Inside: 

• What changes when “it came from a known firm” stops counting as verified 

• What a fax machine, fake letterhead and a spoofed email domain have in common 

• Why auditors will revert back to emailing your financial institution if you ask them to use a platform they don’t trust 

• The questions worth asking any confirmation partner before you trust them with customer data 

Read it before audit busy season.