Familiarity is not verification
Recent guidance on voice cloning makes a practical point for finance, IT and executive teams: a caller can imitate a trusted person, organisation or customer closely enough to create a credible social-engineering scenario. The SoSafe overview of voice-cloning attacks describes how cloned voices can be used to make urgent requests appear familiar. Other recent coverage focuses on the operational challenge of reducing voice fraud without damaging legitimate customer interactions, as discussed by No Jitter.
That should change the control question. Caller ID is not proof of identity. A familiar voice is not proof of identity. A video call is not proof of identity. The relevant question is whether the employee follows an independent process when the caller sounds like the CFO, a relationship manager, a senior client or an internal technology lead.
For a payment approval, that may mean ending the call and using a known number, confirming the instruction through an approved channel, and preserving the evidence. For a beneficiary change, it may require dual control and a documented callback. For a password reset or VIP servicing request, it may mean refusing the shortcut even when the request appears urgent and plausible.
The control has to work under pressure
This is not primarily a detection problem. It is a workflow and behaviour problem.
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that synthetic audio and video can respond to live prompts. Its guidance supports live verification, but also makes clear why verification alone is not enough. Firms need deepfake-resistant controls layered onto a process that does not rely on the apparent caller.
The risk is also becoming a governance issue. Deloitte projects that US generative-AI-enabled fraud losses could reach 40 billion US dollars by 2027 in its aggressive scenario, up from 12.3 billion in 2023, per the Deloitte Center for Financial Services, May 2024. A Deloitte poll of more than 1,100 C-suite executives found that 25.9 per cent said their organisation had experienced at least one deepfake incident targeting financial or accounting data in the prior 12 months. These figures do not tell a board whether its own approval process will hold. A controlled test can.
For firms in scope of DORA, Article 26 requires threat-led penetration testing that targets people, processes and technologies, with ethical boundaries for social engineering. In the UK, the Payment Systems Regulator’s reimbursement regime has applied since 7 October 2024, with reimbursement of up to £85,000 per Faster Payments scam claim. Prevention therefore needs to be evidenced as a control, not assumed from policy wording.
Measure the behaviour, then fix the break
The DeepBlocker Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting two to three weeks. Our AI red team places controlled vishing calls against agreed staff and workflows, such as payment approval, beneficiary change, password reset and VIP servicing. We measure whether people challenge the request, use an independent channel, escalate correctly and preserve the required evidence.
The deliverable is a board-ready evidence pack: who received which scenario, where the workflow broke, what control was bypassed, and which remediation actions should follow. The entry price is around £9,500.
Book an assessment to test whether your verification process works when the voice sounds right.