Floppy disk nostalgia, the two-man rule, and a $25 million deepfake scam

Join Lucky Lopez, Jon Frederick, and Jack Ballinghoff for an all-access look at what’s happening across automotive, breaking down the biggest headlines, industry shifts, and stories dealers need to have on their radar.

🔴 We’re LIVE today at 1 PM ET. Tune in to Automotive Views.

— Freddy

Somebody posted a picture of one of those old plastic floppy disk cases on X last week.

You know, the beige one with the smoky lid and the tiny little lock on the front. The caption was making fun of it as 1990s IT security, which is fair. You could probably open the thing with a paperclip.

But it made me think about how much physical separation used to exist inside a company. Information lived in different places, behind different locks, and accessing one set of records did not give you access to everything else. Those barriers acted as security failsafes by limiting how far any one “breach” could spread. 

It was inefficient as hell, but deliberate.

Meanwhile, the newest generation of AI people are moving in almost the exact opposite direction. They’re trying to get humans out of the process altogether.

I was reading about this new crop of AI such as Jev, built around machine-to-machine interaction, where the idea is basically that conversational software is already kind of outdated because it still assumes a human has to be there talking to it. Now, AI agents can receive information, make a decision, pass structured data to another agent, and keep the whole project moving without waiting on us. 

I understand why people want this, and I’m not saying we go back to floppy disks. I’m simply arguing that we automate a process up to a consequential point, then require human action that digital chains cannot supply.

Like an air gap.

The pipe ends above the drain, leaving actual empty space between the two. If the drain backs up, the sewage cannot travel backward into the clean-water line because there is no continuous path. 

Just look at Arup, which lost about $25 million in 2024 in a case that is almost too perfect for this. Somebody in the Hong Kong finance office got a message from a person claiming to be the company’s UK CFO about a confidential transaction. The employee thought something seemed wrong, so he tried to verify it. He joined a video call where the CFO appeared along with several coworkers. Everybody looked real, everybody sounded real, and over about a week, the employee sent fifteen transfers to five bank accounts.

Turns out, Arup later confirmed that fake voices and images had been used during the verification process.

I find that case pretty disturbing because the employee was suspicious and still got cleaned out. He went looking for confirmation, and the attackers were able to show up there too. But a procedure from fifty years ago would have made their life much harder:

Say an email from your CFO asks you to wire money. You end the video call, find the CFO’s number in a contact list your company already keeps, and dial it yourself. If the real CFO says they never asked for the transfer, you stop. If you can’t reach them, the money waits. The scammers may have arranged both the email and the video meeting, but they don’t get to choose the number for that separate call.

A few months later that same year, Bloomberg reported an attempted scam at Ferrari. An executive started getting WhatsApp messages from somebody pretending to be CEO Benedetto Vigna, then got a phone call using an AI imitation of Vigna’s voice that reportedly reproduced his southern Italian accent. The executive asked for the title of a book Vigna had recommended a few days earlier. The caller hung up, and Bloomberg reported that Ferrari emerged unscathed.

I love how dumb that is. Somebody figured out how to imitate an Italian CEO well enough to reproduce where in Italy he comes from, and the scam dies because two guys had previously talked about a book.

The two-man rule is probably the best one. Above some dollar amount, one person cannot move the money. Somebody else has to approve it, and that person has to understand what they are approving well enough to stop it. Banks have used versions of this forever. And the Department of Defense uses a two-person principle around nuclear weapons, which seems like decent precedent for an accounts payable department.

The callback rule is also worthwhile. A vendor emails new banking details, somebody calls the vendor using a phone number from a register the company already verified. The number in the email is useless for this purpose. The register can literally be printed and sitting on somebody’s desk.

There are a few more I like: 

As an experiment, I built Longhand.

It is a fake consulting company that basically teaches businesses Cold War spycraft and old banking procedures because they plugged AI agents into everything. 

I spent way too much time on it. There is a whole 22-page whitepaper called The Key Ring (reply to this email and I’ll send you a copy). There’s an audit. There’s a ninety-day install. There are procedures for the two-man rule, callbacks, separation of duties, fallback communications, and a bunch of other weird stuff that was normal business practice before we decided every piece of information in the company should live six clicks away from every intern.

Crazy or not, I kind of think it’s a good business.

But we are too busy to do it.

So if anybody wants Longhand, I’ll sell it to you for $25.

Our friend and colleague Adam Gaedke was in a cycling accident near his home in Kohler, Wisconsin, and suffered a critical spinal injury. He underwent major surgery and is now at one of the best facilities in the country for intense physical therapy and recovery.

Adam means a lot to me. He came to Freddy Media after a long career as the COO of the Van Horn Automotive Group. Adam built our dealer services team and will continue to lead it for years to come. He has become one of my closest friends.

Here are some products we find useful and would encourage you to implement in your company.