The call is now part of the attack surface
Reports of charges in a DOJ-linked scheme involving more than $129 million in alleged AI voice-cloning fraud should remove any remaining distance between executive impersonation and operational risk. The reported targets included companies where trust in a senior voice could help move money or sensitive information. Startup Fortune reports on the charges, while PCMag describes the alleged use of cloned executive voices across companies.
The important lesson is not that every call can be identified as synthetic. It is that a familiar voice must no longer be treated as sufficient authorisation.
The pattern is consistent with the Arup incident in early 2024, when an employee transferred about $25 million after a video call involving AI-generated recreations of the CFO and colleagues. CNN Business, citing Arup, and the World Economic Forum described the event as technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email, followed by the deepfake call.
This is a workflow problem before it is a detection problem.
Test the control before the transfer
A Vishing Readiness Assessment is a controlled way to find out whether your people and phone workflows would withstand this sequence. Over a fixed two to three week engagement, DeepBlocker conducts authorised red-team calls against agreed roles and scenarios, such as:
- an urgent payment approval from a managing director;
- a beneficiary or bank-detail change requested by a supplier or executive;
- a password reset or access request from a supposed technology leader;
- a VIP servicing instruction where confidentiality and speed are used to suppress challenge.
The test is designed around the control that matters: can the recipient pause, reject the requested channel and verify the instruction through an independent route already defined by policy?
That may mean calling a known number from the firm’s directory, requiring a second approver, confirming through a separate authenticated system or escalating to a named control owner. The assessment records whether those steps happened before money or sensitive data moved, not whether an employee passed an artificial audio quiz.
Evidence for the board and the regulator
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that attackers can generate synthetic audio and video responses to live prompts. It endorses live verification but makes clear why verification alone is not enough. A voice conversation can be real-time and still fraudulent.
The resulting evidence pack should show which workflow was tested, who received the call, what was requested, which control was expected, where the process broke and what remediation is owned. That is more useful to a board, insurer or regulator than a generic statement that staff completed awareness training.
Per Pindrop’s 2025 report, deepfake voice-fraud attempts rose 1,300 percent in 2024, based on its own telemetry. Deloitte’s 2024 poll found that 25.9 percent of surveyed executives said their organisation had experienced at least one deepfake incident targeting financial or accounting data in the prior 12 months. These figures are signals, not a substitute for testing your own exposure.
Subscribe to DeepFake Weekly by DeepBlocker: deepblocker.ai/newsletter.