Recognition is not the control
AI-generated voices are changing the practical meaning of trust. A caller can sound like a managing director, a relationship manager, a colleague in finance, or a family member. The request may also be familiar: approve a payment, change a beneficiary, reset access, or deal with an urgent client matter.
Recent public guidance is already telling people not to rely on a familiar voice alone. BankSafeOnline’s guidance on voice and deepfake scams reflects the basic principle: stop, end the call, and verify through a trusted route. Recent coverage of family and friend impersonation shows why the same principle applies outside the workplace.
For regulated firms, however, awareness is not evidence. A staff member may be able to list the warning signs in training and still comply with a convincing request when the caller creates urgency, authority and social pressure.
Test the workflow, not the lesson
The important question is therefore not, “Can this person spot a deepfake?” It is, “Will this person follow the firm’s independent verification procedure when the trusted voice says the payment must happen now?”
That procedure needs to survive pressure. It should specify how a payment approval is confirmed, how a beneficiary change is challenged, how a VIP request is independently authenticated, and what happens when the caller insists that normal controls cannot be followed.
A proper test should exercise the whole chain. Can the employee end the call without being persuaded to remain engaged? Do they use a known number rather than one supplied by the caller? Do they escalate to the right person? Does the second approver apply the same standard? Is the exception recorded, reviewed and closed?
The Arup incident illustrates the point. In early 2024, a finance employee transferred about 25 million US dollars after a video call involving AI-deepfaked recreations of the company CFO and colleagues. Arup CIO Rob Greig described the event as technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email before the deepfake call, which is a useful reminder that voice fraud is often a workflow attack rather than a standalone technology event.
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, endorses live audio and video verification but warns that attackers can generate synthetic responses to live prompts. It is advisory guidance, not a binding rule. Its practical message is clear: verification must be independent and supported by controls that do not depend on the apparent identity of the caller.
Produce evidence the board can use
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting two to three weeks. We place controlled AI vishing calls against agreed staff and workflows, including payment approval, beneficiary change, password reset and VIP servicing scenarios.
The output is a board-ready evidence pack: who received the call, what decision was requested, where the workflow broke, whether escalation occurred, and which control changes should follow. It gives the MLRO, Compliance Officer, Head of Risk, COO or CISO evidence beyond completion of awareness training.
The entry price is around £9,500. Book an assessment.