The voice can sound right and still be wrong
Caller identity has traditionally been assessed through familiarity. The voice sounds like the chief executive, the client knows the usual terminology, and the request appears consistent with the relationship. That logic is weakening.
Voice cloning has made tone, confidence and cadence unreliable as evidence of identity. Public guidance now describes how an attacker can reproduce a trusted person’s vocal characteristics and use urgency to request money or sensitive information, as outlined by a credit union fraud advisory and a bank customer-protection guide.
This does not mean every unusual call is synthetic. It means a familiar voice should no longer be treated as authentication, particularly when the caller is asking for a payment, a beneficiary change, a password reset or exceptional VIP servicing.
The risk is not theoretical. In early 2024, an employee at engineering firm Arup wired about 25 million US dollars after a video call involving AI-deepfaked recreations of the CFO and colleagues, per CNN Business and Arup’s confirmation. Arup CIO Rob Greig described the event as technology-enhanced social engineering. The initial contact was a phishing email, which then created the path to the deepfake call.
Guidance is clear: verification must be independent
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, identifies executive-impersonation vishing as a fraud typology. It endorses live audio and video verification, but also warns that an attacker can generate synthetic responses to live prompts. The guidance is advisory, not a binding rule, but its control implication is important: verification alone is not enough if the verification channel can also be manipulated.
A stronger control is independent verification. End the call. Use a known number or an established internal route. Confirm the request with a second person where policy requires it. Record the decision and escalate when the request conflicts with normal authority, timing or payment controls.
Awareness training can explain those steps. It cannot prove that an employee will follow them while a convincing caller is applying pressure. That is a control-testing gap, not a training-completion gap.
DORA Article 26 provides a useful regulatory direction for firms in scope. Its threat-led penetration testing approach explicitly includes people, processes and technologies, with ethical boundaries for social engineering. In the UK, the Payment Systems Regulator’s APP-fraud reimbursement regime has applied since 7 October 2024, requiring reimbursement of eligible Faster Payments scam claims up to £85,000. That makes the quality of payment approval and escalation controls a balance-sheet issue as well as a conduct issue.
Test the workflow, not the confidence
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting two to three weeks. We place controlled AI voice-fraud calls against agreed staff and workflows, such as payment approval, beneficiary change, password reset and VIP servicing.
The result is a board-ready evidence pack: who received the call, what happened, which control was followed or bypassed, where escalation failed, and what remediation should be prioritised. It gives the MLRO, Compliance Officer, Head of Risk, COO or CISO evidence beyond a policy attestation or a completed awareness module.
The entry price is around £9,500. Book an assessment to test whether your voice-fraud controls work under realistic pressure.