A familiar voice is no longer proof of identity. A caller can sound like your manager, a family member, a vendor, or a bank representative because an attacker has cloned a few seconds of publicly available audio. A video call can add a convincing face and office background. The request is still fraudulent, even when the performance feels real.

This is the new social-engineering layer on top of vishing (voice phishing), business email compromise, and payment fraud. The technology changes the trust signal attackers can imitate; it does not change the safest response. Slow down, refuse the risky action, and verify through a channel the caller did not choose.

The FBI’s San Francisco warning on AI-enabled fraud and impersonation scams and the FBI Internet Crime Complaint Center (IC3) 2024 Annual Report describe the broader risk: criminals can use generative AI to make impersonation more persuasive. You do not need to identify a perfect synthetic-media artifact to make a safe decision.

What AI voice and deepfake video change

Classic phishing often asks you to trust an email address, a link, or a login page. Vishing asks you to trust a live conversation. Deepfake video asks you to trust the face, voice, and apparent setting together. That combination can make a high-pressure request feel like an exception to normal controls:

Caller ID can be spoofed. Voicemail can be generated or edited. A known-looking video meeting invitation can be sent by a compromised account. A familiar voice or face is useful context, but it is not authentication. The NSA, FBI, and CISA Cybersecurity Information Sheet, “Contextualizing Deepfake Threats to Organizations” (2023), makes the same operational point: organizations need layered processes because synthetic media can undermine human and technical trust signals.

Practice scenario

An urgent voice request from your CFO

A supposedly familiar CFO voice urgently asks you to transfer money to a new account. What should you do first?

Choose the safest first step:

Anonymous exercise: it does not ask for or store personal or financial data.

Red flags to notice before you act

Look for the behavior of the request, not just the quality of the audio or video. One red flag is enough to pause. Several together should end the interaction until you verify it independently.

Unsolicited contact plus urgency

Be cautious when someone calls or starts a video meeting unexpectedly and says you must act now. “Keep this confidential,” “the account will be locked,” “the CEO is waiting,” and “there is no time for the usual process” are pressure tactics. Genuine emergencies still have a safe way to confirm them.

Authority pressure and requests for secrets

A real colleague may ask you to complete a normal task. They should not need your password, MFA approval, one-time code, recovery code, or full payment credentials. A caller who asks you to read a code aloud, approve an unexpected sign-in, install remote-control software, or move money is asking for a high-risk action. Stop.

Payment or account changes

Treat a new bank account, changed wire instructions, gift-card request, payroll change, cryptocurrency transfer, or urgent refund as high risk—especially if the instruction arrives through a call or video. A convincing voice does not override dual approval or a callback procedure.

Caller-ID, callback, and channel problems

Do not trust the number shown on your screen, the number in a voicemail, or a callback link supplied during the conversation. The Federal Trade Commission’s impersonator-scam guidance recommends using contact information you know is real. Open the organization’s app or website yourself, use a number from a trusted directory or statement, or contact the person through an established channel.

Unusual audio or video behavior

Pauses that do not fit the conversation, unnatural turn-taking, repeated phrases, lip-sync or lighting changes, a frozen image, odd eye movement, or a request to move platforms may be useful clues. So may an answer that sounds polished but avoids an unscripted question. These clues are not proof either way. People have poor connections, disabilities, accents, fatigue, and ordinary video glitches. No single visual, audio, or detector signal proves authenticity.

That is why you should not turn the conversation into a contest to expose a deepfake. If the request is sensitive, end the contact and verify it separately.

A safe response for individuals

Use this short sequence at home or at work. Practice it before you are under pressure:

  1. Pause. Take a breath and say, “I do not approve sensitive requests on an unexpected call. I will verify this independently.”
  2. Refuse the secret or approval. Never disclose credentials, MFA or one-time codes, recovery codes, card details, or account answers. Do not approve a login, install software, or authorize a payment because a caller asks.
  3. End the contact. Hang up, leave the video meeting, and do not keep negotiating. Do not call back the voicemail number or use a link sent in the conversation.
  4. Verify independently. Call a known number from your contacts, corporate directory, bank statement, or the organization’s official website. For a coworker, start a new message or call in the company’s normal system—not the thread or meeting invite that made the request.
  5. Report it. Tell your bank, IT/security contact, manager, family member, or service provider. Save the evidence before deleting messages or blocking the account.
  6. Escalate quickly if you shared anything. If you disclosed account information, approved MFA, installed software, or sent money, say exactly what happened and when. Speed gives the bank and security team the best chance to stop access or recall funds.

For a compact version to share with your team, use the free Vishing Defense Playbook. It turns the same pause-and-verify behavior into a repeatable checklist.

What teams should put in the process

Training people to “spot the deepfake” is not enough. Detection tools can miss new attacks, and ordinary people cannot be expected to judge a synthetic voice reliably during a stressful call. The control should make the risky action fail safely even when the impersonation sounds convincing.

1. Require out-of-band verification

Any sensitive request received by phone, video, text, or chat must be confirmed through an independent, known channel. Use a corporate directory number, an existing vendor record, or a new message to a known account. Do not use the contact details provided in the request. Record the verification step with the approval.

2. Use an unscripted challenge for high-risk requests

Ask a question that is not available in the caller’s message or public profile. Do not rely on a question whose answer is in a social-media post. The challenge is a supporting control, not a replacement for the known-channel callback: a real person may forget an answer, and an attacker may have researched it.

3. Separate payment preparation from payment approval

Set dual approval, amount thresholds, and a documented callback for new beneficiaries and changed bank details. Make the rule explicit: no transfer is authorized on the strength of a call or video alone. A second approver should independently verify the request, not simply approve the first approver’s notes.

4. Protect sensitive accounts with phishing-resistant MFA

Use passkeys, FIDO2 security keys, or other phishing-resistant MFA for email, identity administration, finance, and remote access where available. MFA does not validate a caller, but phishing-resistant MFA reduces the chance that a person can be manipulated into giving an attacker a reusable login secret or approving a fraudulent sign-in. Microsoft’s MFA overview explains the protection MFA adds; do not treat MFA as a substitute for payment verification.

5. Make reporting blame-free and practice the scenarios

A person who nearly approved a deepfake request is an early-warning sensor, not a disciplinary example. Give everyone one clear reporting route and make it acceptable to pause a senior person’s request. Run recurring, scenario-based exercises for Finance, executives, help desk, and family-facing staff: an urgent CFO call, a vendor bank-detail change, an MFA-code request, and a family emergency. Debrief the process, not the person.

Facilitated tabletop exercise

10-minute team tabletop: the urgent CFO wire

Facilitator setup: Set aside 10 minutes. Name a Finance owner to pause and hold the transfer, an independent second approver, a scribe, and a security escalation contact. Assign participants to those roles before the discussion.

Prompt

A familiar-sounding CFO calls or joins a video meeting and urgently asks Finance to wire funds to a new account. The usual approval window is closing, but no transfer has been sent. What happens next?

Discuss

  1. Who pauses the transfer, and how does the Finance owner keep it on hold while the request is checked?
  2. How will the team verify the request through the corporate directory or another known-good channel independent of the call or video? Who makes the callback, and how does the second approver independently confirm it?
  3. If the request cannot be verified, or someone has already acted, what does the scribe record—such as the time, request channel, verification attempts and result, actions taken, and people notified—and who is escalated to promptly?

Debrief

Keep the transfer on hold until an independent out-of-band callback confirms the request through a known-good channel, then require dual approval. A call or video alone is never enough to authorize payment. If verification fails, escalate promptly to the security contact and Finance owner. If anyone already acted or funds moved, notify security and the bank or payment provider immediately through a known-good channel. Preserve the timeline and verification evidence, and make reporting blame-free so the team can respond quickly.

Discussion only: do not place real calls, initiate or simulate payments, use actual account details, or disclose credentials or other sensitive information.

This is where expert-led coaching helps. A live, scenario-based session can rehearse the exact callback language, challenge questions, dual-approval handoff, and reporting path your team needs. It complements technical controls; it does not pretend a detection product can replace training and verification.

For context on why phishing-resistant authentication and human reporting work best together, see the Identity-Based Attacks: The 2026 Playbook.

First-hour checklist for suspected or successful fraud

Do these in parallel when possible. If you are at home, contact your bank and service providers first. If you are at a small business, assign an incident lead and keep a written timeline.

  1. Stop the action. Do not send more money, codes, documents, or replies. Disconnect remote access software if it was installed, but do not wipe the device before guidance from IT or an investigator.
  2. Preserve evidence. Save the phone number, caller-ID display, voicemail, meeting invite, chat messages, email headers, payment instructions, screenshots, recording if lawfully available, and exact timestamps. Write down what was said and what was disclosed while it is fresh.
  3. Contact the bank or payment provider. Ask whether a transfer can be stopped, recalled, or flagged as fraud. Use the number on your bank card or official statement. For business wires, ask about the bank’s fraud-recovery or Financial Fraud Kill Chain process.
  4. Notify the right owners. Contact IT/security, the manager or incident lead, Finance, and relevant legal or leadership owners. A person at home should tell the bank, affected account provider, and a trusted family member who can help keep the response calm and organized.
  5. Contain account exposure. From a known-clean device, change passwords for affected accounts, revoke active sessions and unfamiliar app access, review MFA methods and forwarding rules, and tell the security team if an MFA approval or recovery code was exposed. Do not reuse the old password.
  6. Report through the applicable channel. File with the FBI IC3 complaint form for internet-enabled crime, contact local law enforcement when appropriate, and use the bank, platform, or provider’s fraud-reporting path. Keep the confirmation number with your incident notes.
  7. Review and improve. After the immediate response, identify which control failed or was unclear: directory data, callback ownership, payment thresholds, MFA enrollment, or reporting. Update the playbook and practice the corrected scenario.

If money moved or account data was exposed, do not wait for certainty about whether the voice or video was synthetic. The response is the same: contain, preserve, notify, and report.

Sources & Further Reading

Want to rehearse this with your team? Book a SecurEveryone coaching session for a live workshop built around your voice/video impersonation, callback verification, and payment-request scenarios.