Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake.
The call comes in at 4:40 on a Friday. It’s the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes Monday. She’s traveling, she’s rushed, and she apologizes for the bad connection. Ten minutes later an email lands with the wire details.
A couple of years ago that scenario was a conference talk. Now it shows up in incident reports. In a 2025 Gartner survey of 302 cybersecurity leaders, 62% said their organization had experienced at least one deepfake attack in the prior 12 months. In the same survey, 43% reported at least one deepfake audio call incident and 37% had run into deepfakes on video calls.
And the wire is only the obvious ask. The same cloned voice can call the help desk to move an MFA token, or ask an identity admin to set up a new global admin ahead of an “audit.” A fraudulent wire tends to surface at reconciliation. A quietly added admin account can sit there for months.
Most organizations have a policy that says to verify unusual payment and access requests. Far fewer have checked whether that policy survives a phone call from someone who sounds like the person who signs off on everyone’s paycheck. A deepfake readiness drill is how you find out, on your own schedule, with nothing real on the line.
Why detection by ear falls short
Security awareness training has long taught employees to look for tells. Awkward phrasing, an odd sender address, a link that doesn’t match the text. Voice clones and real-time face swaps leave fewer of those tells every quarter. Asking people to hear the fake is asking a lot.
In a May 2025 warning about AI-generated voice messages impersonating senior US officials, the FBI noted that cloned voices can sound nearly identical to the real person and told recipients to confirm identity by calling an independently sourced phone number before acting on anything.
Security leaders already know this. In a January 2026 Osterman Research study of 128 US security and IT leaders, commissioned by IRONSCALES, 60% said they lacked confidence in their ability to counter deepfake attacks even with the training they already run.
So the defense has to rest on process more than perception. If an employee runs the same verification step every time money, credentials, or permissions are involved, the quality of the fake stops mattering much. A drill tests whether that step actually happens when someone senior is leaning on them.
Step 1. Map the voices worth cloning and the people worth calling
Start with two short lists.
The first is the people an attacker would impersonate. That means executives who can approve payments or direct staff (CEO, CFO, CIO, CISO, general counsel). Then go a level down. VPs and directors in finance, IT, and HR make requests like these every week, so a call from one of them raises fewer eyebrows than a surprise call from the CEO. Add a few outside contacts with real authority over money or access, like a key supplier’s accounts receivable lead or the engineer at your managed service provider.
The second is the people an attacker would call. Accounts payable, treasury, payroll, HR, executive assistants, the IT help desk, and anyone who can grant or change access in your identity platform. The help desk and the identity admins get left off these lists a lot. They shouldn’t be. A cloned voice asking for an MFA reset is a fast route to Account Takeover (ATO). A cloned voice asking for a new admin account skips a few steps.
For everyone on the first list, note how much public audio and video exists. Earnings calls, podcast appearances, conference keynotes, webinar recordings, and social media clips all give an attacker training material. A CFO with three hours of recorded keynotes is a much easier clone than one who’s never been on camera. It doesn’t take three hours, though. A few minutes from a single webinar can be enough, which puts most directors on the list too.
What comes out of this step is a short matrix: the identities most worth faking and the people most likely to get their calls. In most organizations that’s a few dozen people. Manageable.
Step 2. Write the verification rules before testing them
A drill without a clear rule only measures instinct. Before running any scenario, document what employees are supposed to do. Strong verification rules tend to share a few traits.
- Out-of-band callback. Any request to move money, change bank details, share credentials, reset MFA, or change who has access to what gets confirmed through a number pulled from the internal directory or vendor master file. Never a number supplied in the request itself.
- Clear thresholds. Spell out which actions always require verification, no matter who’s asking or how urgent it sounds.
- Dual approval. Two people sign off on new payees, changed banking details, new privileged accounts, and role changes.
- Challenge phrases. The most-impersonated executives and their direct support staff share a phrase that rotates on a schedule.
- No-blame reporting. Anyone who realizes they already acted on a suspicious request (paid it, reset it, granted it) reports it right away, and nobody gets shamed for it. Shame the first person who comes forward and the next one with that sinking feeling keeps quiet while the attacker keeps working.
- Explicit permission to pause. The CEO and CFO tell their teams, in writing, that nobody gets in trouble for hanging up and calling back.
Don’t skip that last one. Deepfake fraud runs on urgency and hierarchy. An employee who thinks slowing down a VP will cost them at review time is the easiest target in the building. So tell people to trust their gut. The voice can be perfect and the request can still feel wrong, and that feeling is worth listening to even when they can’t explain it. My advice to every team I talk to: don’t just do something, stand there. A minute of standing still and one callback costs nothing. Acting on the fake costs a lot more.
Step 3. Design multi-channel scenarios
Real attacks rarely show up as a single phone call. They usually start in email or chat to set up context, then move to voice or video to apply pressure. Drill scenarios should follow the same path.
Before building anything, get sign-off from legal, HR, and every executive whose identity will be used. Cloning someone’s voice without consent creates its own set of problems. Many teams use a consenting executive’s voice, a clearly labeled synthetic stand-in, or a live actor working from a script.
Four starter scenarios cover most of the risk.
- Urgent wire from the CFO. A spoofed email flags a confidential acquisition payment, followed by a voicemail in the CFO’s voice asking the controller to process it before end of day.
- Supplier bank change. A message from a known vendor contact announces new banking details, followed by a Microsoft Teams call from the “vendor” to confirm the update.
- Help desk reset. A caller who sounds exactly like the VP of sales says she’s traveling, locked out, and needs MFA moved to a new phone before a board meeting.
- Access cleanup. An email from the CISO’s office announces a quarterly permissions review. Then a Teams call from the “IT director” walks an identity admin through it. Strip excess rights from five users who don’t need them, and while you’re in there, add a contractor account to a privileged group for the auditors. The cleanup is good hygiene. The one addition is the attack.
Time the scenarios around the same pressure points attackers pick. Quarter close, audit season, the days before a holiday, and weeks when executives are publicly known to be on the road.
Step 4. Run it in stages
Start with a tabletop exercise. Walk the target group through each scenario in a conference room and ask what they’d do at every step. It surfaces policy gaps cheaply. (Someone almost always asks which number they’re supposed to call, and nobody in the room is sure.)
Then move to live simulations with a small group. A few ground rules keep it safe.
- Brief a small control group. The executive sponsor, the SOC lead, and the head of finance should know the drill is running so a real escalation doesn’t kick off a real incident response.
- Keep money and access out of reach. Use a test payee, a payment request that stops at approval, and a sandbox group with no real privileges. Nothing real should be able to move.
- Set stop conditions. If a participant gets distressed or the scenario starts bleeding into real business, end it and debrief on the spot.
- Tell participants afterward, every time. A drill that feels like a trap burns the trust the whole program depends on.
Step 5. Measure what actually happened
A single pass/fail score is the least useful number a drill produces. The behaviors underneath it tell security teams far more.
- Verification rate. The share of participants who used the documented callback or challenge step before acting.
- Time to escalation. How long it took someone to report the request to security, if anyone did.
- Report path. Whether the report reached the SOC through the expected channel or stalled in a manager’s inbox.
- Break points. The exact step where the process failed. No directory number, an unclear threshold, or the “executive” pushing to skip the callback.
- Bundled requests. In the access scenario, whether anyone questioned the privilege grant tucked inside the cleanup, or approved the whole batch because most of it looked right.
- Trust signals cited. What participants say convinced them. “It sounded exactly like him” and “the email came first, so I assumed it was real” point to very different fixes.
Spend the most time on the break points. Each one maps to a specific fix in policy, tooling, or training.
Step 6. Debrief, fix, and repeat
Keep debriefs blameless and fast, ideally the same day. Most people who fall for a good drill feel lousy about it. Tell them it was built to fool them, because it was. Then walk participants through what was fake, how it was built, and which signals they could have checked. Fix what broke. Update the callback directory, tighten thresholds, and fold the scenarios into the regular phishing simulation program so the lessons don’t fade after one round.
Repeat the drill at least twice a year, and any time the high-exposure list changes. A new CFO, an acquisition, or a heavy conference season all count. Rotate scenarios so nobody passes by recognizing the script.
Where technology fits
Process carries most of the load. Tooling helps at two points in the attack chain.
The first is the setup message. Most voice and video deepfake attempts are preceded by an email or chat message that establishes context. Behavioral email security that flags unusual requests from executives, managers, or vendor contacts can break the chain before the call ever happens.
The second is the call itself. Real-time identity verification for collaboration platforms like Microsoft Teams analyzes voice and video during a meeting and warns participants when someone doesn’t match the identity they claim. Many detection tools look for artifacts, the glitches a generator leaves behind, and those get harder to spot with every model release. A sturdier approach checks the person, comparing behavioral and biometric signals against a profile of the real speaker. When evaluating these tools, look closely at privacy, specifically whether they record or transcribe meetings or only process signals in the moment. IRONSCALES, the first and only email security platform with deepfake protection built into the product, takes the behavioral and biometric route for Microsoft Teams meetings. It works from mathematical voice and face profiles, with no recordings or transcripts kept.
Start small, start this quarter
A first drill doesn’t need a budget line. Two lists, one page of verification rules, four scenarios, and a debrief template are enough to learn where you actually stand.
For finance and compliance teams that want more detail on warning signs, FinCEN’s alert on deepfake fraud schemes describes criminals using generative AI to impersonate executives and direct employees to transfer funds. One of its red flags is worth building straight into the drill. Watch for anyone who switches communication methods mid-conversation and blames technical glitches. That “bad connection” from the CFO on a Friday afternoon is exactly the moment to hang up and call back.
Note: This article has been expertly written and contributed by Audian Paxson, Principal Technical Strategist, IRONSCALES.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
