If your approval process ends with "I saw them on the call", you no longer have an identity check.
The Hacker News reports that the FBI has established that threat actors tied to North Korea stole more than $400 million worth of cryptocurrency through a social engineering scheme codenamed FaceStealer over the last 18 months, part of a coordinated set of actions announced by the U.S. government.
I have built KYC and withdrawal flows long enough to know where this bites: the strongest controls usually sit at user onboarding, while hiring and vendor setup stay human and informal, and manual withdrawal overrides do too. Those are the paths worth hardening. Confirmation on a second channel the caller does not control, and two separate people approving anything that moves funds or grants access.
I review payment and account flows for exactly this: the spots where a human decision stands in for a verified one. Send me your withdrawal and approval paths and you get the weak points back, with cost and timeline, within a day.