The channel is part of the control environment
The U.S. Courts reported that a cybersecurity incident affecting BAE Systems disrupted IT systems and websites supporting the Bankruptcy Noticing Center. The notice does not say that vishing caused the incident, and it would be wrong to imply that it did. The operational lesson is separate: when a trusted channel is disrupted, people begin working around normal processes.
That is when a phone call can become unusually persuasive.
A delayed notice, an unavailable portal or a changed contact route creates urgency. An attacker who claims to be from a supplier, an internal technology team, a court-related service or a senior executive does not need to defeat the primary system if they can persuade an employee to bypass the normal control. The U.S. Courts’ incident notice is therefore relevant to more than cyber incident reporting. It is a prompt to examine how operational teams behave when trusted infrastructure is unavailable.
This is not a case for panic or for banning the telephone. It is a case for knowing which requests must remain independently verifiable, even under pressure.
Test the decision, not the employee’s memory
The practical question for a security or operations leader is not whether staff have heard of AI voice cloning. It is whether they can safely handle a high-impact request when the caller sounds familiar, the business context appears plausible and the usual system is unavailable.
Consider workflows such as:
- approving an urgent payment or changing a beneficiary;
- resetting credentials while an application is disrupted;
- accepting new bank details from a supplier;
- releasing sensitive information to a purported regulator or service provider;
- giving a senior executive exceptional treatment during an incident.
A voice that resembles a trusted person is not authentication. The general guidance on AI voice-cloning scams is useful for explaining the threat, but awareness content cannot demonstrate whether a particular workflow survives a credible call.
The stronger test is authorised and controlled. Can the employee pause without being penalised for delay? Do they know which independent channel to use? Is there a second-person approval rule that remains practical during an outage? Are exceptions logged, reviewed and escalated? Does the process distinguish a genuine service disruption from a reason to abandon verification?
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that synthetic audio and video can be generated in response to live prompts. Its guidance is advisory, not a binding rule, but the operational point is clear: verification alone may not be enough when the verification channel itself can be manipulated.
Per Pindrop’s 2025 report, deepfake voice-fraud attempts rose 1,300 percent in 2024. That is single-vendor telemetry, not a universal measure, but it reinforces why regulated firms should test the workflow rather than rely on confidence in the caller’s voice.
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised exercise that places controlled calls against defined workflows and returns sealed evidence of where decisions held or failed. Follow the founder for sober, evidence-led field notes on making voice workflows resilient.