A synthetic identity does not need to defeat a security product to create loss. It needs to sound credible to the person who can approve a payment, amend payroll details, reset access or service a high-value client.
That is why deepfake readiness is becoming an operational question, not only a cybersecurity question. Recent commentary describes deepfakes becoming an HR incident, with identity treated too readily as established by a familiar face or voice according to HR News. For a regulated organisation, the relevant question is not whether an image, voice or video is genuine in isolation. It is whether the surrounding workflow can resist a plausible impersonation under pressure.
Trust is distributed across departments
Consider the control points:
- Recruiting receives a video interview, references and identity documents from a candidate who may not be the person represented.
- Payroll receives a call requesting a change to bank details, supported by an urgent message from a supposed senior manager.
- Executive communications circulate a voice note or video instruction that appears to come from the chief executive.
- Client servicing receives a call from a VIP asking for an exceptional transfer, beneficiary change or urgent account action.
- IT service desks reset passwords after a caller supplies information gathered from public sources or a prior compromise.
Each team may have completed phishing training. That does not demonstrate that its live phone workflow will hold when the caller is persuasive, the request is plausible and the usual colleague is unavailable.
The Arup incident remains a useful warning. In early 2024, a finance employee wired about 25 million US dollars after a phishing email led to a video call using AI-deepfaked recreations of the CFO and colleagues. Arup CIO Rob Greig described it as technology-enhanced social engineering, noting that systems were not compromised and data was not affected. The lesson is about workflow authority, not simply about media quality.
Test the decision, not just the signal
Detection tools can contribute to a control environment, but they do not answer the operational questions a board or regulator will ask:
Who was authorised to approve the action? Which independent channel was required? Could the employee pause without penalty? Was the callback destination trusted? Did the case reach compliance, risk or security? Was the exception logged and reviewed?
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that synthetic audio and video can be generated in response to live prompts. It endorses live verification while making clear why verification alone is not enough. The control must include a second, trusted route and a process that survives an uncertain interaction.
The World Economic Forum has likewise argued that financial institutions should verify digital evidence independently, particularly around high-risk payments and trade finance in its guidance on independent verification. That principle applies across departments. A voice can be convincing and still be unauthorised.
Evidence before the high-trust workflow
A useful readiness exercise should therefore cross departmental boundaries. It should test recruiting, payroll, executive support, client servicing and service desk routes against agreed scenarios, with authorisation and safeguards in place.
DeepBlocker's Vishing Readiness Assessment is a fixed-scope, 2 to 3 week engagement. We place controlled calls against nominated staff, observe where the workflow breaks, and return sealed evidence showing who was fooled, which controls were bypassed and what remediation should be prioritised. The output is designed for the board, insurer and regulator, not only the security team.
This is the gap between saying people have been trained and proving that the organisation can resist a synthetic identity when trust is being exercised.
Take the free demo.