The most dangerous change in voice fraud is not that synthetic speech has become more convincing. It is that familiar signals are becoming less trustworthy.
A caller ID can look right. An executive’s voice can sound right. A video meeting can show the right face. None of those facts proves that the person on the other end is authorised to approve a payment, change a beneficiary, reset a password or release sensitive information.
Recent coverage is bringing this problem into sharper focus. Practical guidance from SoSafe on voice-cloning attacks and Adaptive Security on deepfake video-call scams reflects a shift from hypothetical concern to operational risk. The question for a compliance officer or head of risk is no longer whether an employee could spot a fake. It is whether the organisation’s process still works when the familiar signals are deliberately manufactured.
The evidence is moving from theory to workflow risk
In early 2024, a finance employee at engineering firm Arup wired about 25 million US dollars after a video call involving AI-deepfaked recreations of the company CFO and colleagues. Arup’s CIO, Rob Greig, described the incident as technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email before the deepfake call, a reminder that these attacks are campaigns rather than isolated technical tricks. CNN Business, the World Economic Forum, Deloitte and the FinCEN alert have all cited the Arup case.
The attack succeeded because the video call was placed inside a credible business context. The failure was not simply an inability to identify a synthetic face. It was a failure to preserve independent authority, channel separation and payment control when a senior-looking group applied pressure.
Deloitte’s 2024 poll of more than 1,100 C-suite executives found that 25.9 per cent said their organisation had experienced one or more deepfake incidents targeting financial or accounting data in the prior 12 months. That is a specific scope, not a claim that every deepfake attempt succeeds. It does, however, show why the issue belongs in financial crime and operational resilience discussions.
Voice fraud is becoming a control problem
Per Pindrop’s 2025 Voice Intelligence & Security Report, deepfake voice-fraud attempts rose 1,300 per cent in 2024. Its telemetry also reports that US contact-centre fraud attempts occur roughly every 46 seconds, with synthetic-voice attacks growing fastest in insurance, up 475 per cent, and banking, up 149 per cent. Pindrop is a single-vendor source, so these figures should be treated as directional telemetry rather than a universal market census. They are still relevant to firms deciding whether voice channels deserve formal testing.
Deloitte’s Center for Financial Services projects that US generative-AI-enabled fraud losses could reach 40 billion US dollars by 2027, compared with 12.3 billion in 2023. The 40 billion figure is the aggressive scenario. Deloitte’s conservative scenario is around 22 billion. The important point for a regulated firm is not the forecast’s precision. It is that the potential loss is large enough to justify examining the controls that allow a voice instruction to become a financial event.
Live verification is necessary, but not sufficient
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns financial institutions about generative-AI deepfake fraud and executive-impersonation vishing. The alert endorses live audio and video verification, but also warns that attackers can generate synthetic audio and video responses to live prompts. It is advisory guidance, not a binding rule.
That distinction matters. A live call can be useful evidence, but it should not automatically be treated as independent proof. If the attacker controls the voice, image, device or communication channel, asking a question on the same channel may only produce another convincing answer.
The practical response is not to tell staff to become forensic analysts. It is to design workflows in which no single voice, face, caller ID or urgent request can complete a high-risk action.
Test the decision, not just the technology
A useful exercise begins with concrete workflows:
- a payment approval requested by a senior executive;
- a beneficiary change received during a live call;
- a password reset for a privileged user;
- an urgent request from a high-value client;
- a contact-centre escalation involving confidential account information.
For each workflow, ask what the employee is expected to do, which channel is considered trusted, who can approve an exception and whether the independent callback route is genuinely independent. Then test it with an authorised, controlled vishing scenario.
The outcome should not be a pass or fail based on whether an employee noticed an unusual accent or facial movement. Those cues are inconsistent and can unfairly place responsibility on individuals. The useful evidence is more specific: who received the request, what information was disclosed, which control was bypassed, whether escalation occurred, and how long it took to contain the situation.
Regulation is already pointing towards testing
DORA has applied since 17 January 2025. Article 26 requires Threat-Led Penetration Testing under the TIBER-EU framework, with explicit attention to people, processes and technologies and defined ethical boundaries for social engineering. DORA is an EU regulation, but its approach provides a useful benchmark for any regulated firm building a recurring resilience programme.
In the UK, the authorised push payment reimbursement regime has applied since 7 October 2024. The Payment Systems Regulator requires banks to reimburse victims up to £85,000 per Faster Payments scam claim. Many such scams are vishing-induced, making every prevented voice scam a potential balance-sheet saving, as well as a customer-protection outcome.
Evidence is the deliverable
The right question after a test is not, “Can our people spot an AI voice?” It is, “Can our workflow withstand a credible impersonation when the request is urgent and the surrounding signals look familiar?”
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting two to three weeks. We place controlled vishing calls against agreed workflows, then return a sealed, board-ready evidence pack showing who was fooled, where the process broke and which controls need strengthening. Entry pricing is around £9,500.
For a board, insurer or regulator, that evidence is more useful than a general awareness statement. It shows how the organisation behaved under pressure, in the channels where a real loss could begin.
Subscribe to the DeepBlocker intelligence for evidence-led analysis of voice-fraud readiness.