The control gap is no longer just an inbox
Most phishing programmes are designed around an observable event: a suspicious email arrives, an employee reports it, and the security team measures completion of the training. That is useful hygiene. It is not evidence that a person will resist a credible call arriving outside the corporate email perimeter.
The caller may use a personal mobile number, a messaging app, or a familiar-looking caller ID. They may refer to a transaction already under discussion, imitate a senior executive, or ask an employee to continue the conversation away from monitored systems. The request can then be framed as an urgent payment approval, beneficiary change, password reset, or VIP servicing exception.
Recent explainers on voice-cloning fraud describe the same practical concern: a familiar voice can be used to create urgency and request money or information, without first compromising the organisation’s systems. See Stregabyte’s overview of voice-cloning scams and this summary of known deepfake fraud cases.
That is why “we completed phishing training” is not the same statement as “our payment controls resisted an impersonation attempt”.
Detection is not a substitute for a resilient workflow
The evidence is moving beyond theoretical concern. In early 2024, a finance employee at engineering firm Arup wired about 25 million US dollars after a video call involving AI-deepfaked recreations of the company CFO and colleagues, as reported by CNN Business and confirmed by Arup. Arup CIO Rob Greig described the incident as technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email, but the decisive manipulation happened in a live interaction.
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns financial institutions about GenAI deepfake fraud and executive-impersonation vishing. It endorses live audio and video verification, while also warning that attackers can generate synthetic responses to live prompts. The implication is important: verification may be one control, but it is not proof on its own. The surrounding process must still require independent confirmation, separation of duties, and a safe route for refusing or escalating an unusual request.
The UK Payment Systems Regulator’s reimbursement regime, live since 7 October 2024, requires banks to reimburse victims up to £85,000 per Faster Payments scam claim. For regulated firms, a failed call is therefore not merely a training issue. It can become a measurable operational, customer, and balance-sheet exposure.
Test the people and the process together
A Vishing Readiness Assessment gives risk owners evidence that tabletop exercises and completion rates cannot provide. Over two to three weeks, an authorised AI red team places controlled calls against agreed roles and workflows. The engagement tests whether staff challenge the caller, use an independent channel, follow approval thresholds, and record or escalate the event correctly.
The output is a sealed evidence pack: who was fooled, which control failed, what the workflow permitted, and what remediation should change. It is designed for a board, an insurer, or a regulator, not as a leaderboard of individual employees.
Training remains part of the answer. It should sit inside a tested control environment, rather than stand in for one. Take the free demo to see what a controlled vishing test would reveal in your organisation.