Deepfake Vishing: When the Boss Calls with a "Crisis"

Separate a recognizable voice from authority

Vishing is voice-based social engineering. Deepfake audio can make an impersonation sound familiar, but a recording alone does not tell you whether a request is legitimate. The historical headline describes a scenario to prepare for, not a report that a particular executive or organization has been compromised.

The FBI has warned that criminals use generated audio and video in fraud, including impersonation of public figures and apparent company executives. The leadership implication is practical: do not make a familiar voice or face the sole approval mechanism for a consequential action.

Source: FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud →

Rehearse the moment of pressure

Imagine a hypothetical finance employee receiving a call that sounds like the chief executive. The caller says a confidential transaction is about to fail and asks for an urgent payment to a new destination. A follow-up message supplies paperwork and insists that normal reviewers must not be involved.

The employee does not need to prove that the audio is synthetic before pausing. A new payment destination, unusual secrecy, and pressure to bypass approvals already justify verification. Build procedures around the requested change and its consequence so they remain useful whether the caller uses AI, a convincing impression, or a compromised account.

Use an independently trusted route

The FTC’s advice for voice-cloning scams includes contacting the supposed caller through a number already known to be theirs. The same principle applies at work: establish a verification route before the suspicious request arrives. Do not rely on a phone number or link supplied in the request itself.

For the hypothetical payment, the employee follows the organization’s existing payment-control process and contacts the designated approver through a trusted directory. Verification should confirm the transaction details, including the destination and purpose, rather than merely asking whether the executive is busy. If the route is unavailable, use a preauthorized alternate, not the caller’s replacement contact.

Source: FTC: Scammers use AI to enhance their family emergency schemes →

Make the rule apply to senior people

A control fails culturally when employees believe it is acceptable for ordinary requests but career-limiting when an executive is impatient. Leaders should state that verification is expected, including for their own requests. Practice a short response: the employee will verify through the standard channel before proceeding.

Keep the procedure usable during travel, after hours, and when a primary approver is unavailable. An emergency route can be faster while still requiring authenticated approval and appropriate separation of duties. A claimed crisis should change the escalation speed, not silently remove the checks.

Protect more than payments

Review the other actions a persuasive call could trigger. A service desk may be asked to reset access, an assistant may be asked for a confidential document, and a supplier manager may be asked to change bank details. Each workflow needs its own verification and approval rules.

Do not turn shared personal trivia into the primary defense. Names, meeting details, and company events may be public or known to a compromised account. A private code phrase can be one supporting control, but it can also be disclosed or reused. Prefer a process tied to verified identities, authorized actions, and recorded decisions.

Run a respectful tabletop

Use a clearly authorized exercise with synthetic details. Ask participants what they would do when the familiar caller refuses a callback or claims that a second approver is unavailable. Test the escalation route and the clarity of the policy. There is no need to clone a real person’s voice to find process weaknesses.

• Which actions require independent verification?
• Where does the employee find trusted contact information?
• Who is the alternate when the usual approver is unreachable?
• How are changed payment details or access requests confirmed?
• What evidence is preserved if the request appears fraudulent?

Prepare the response to a request that slipped through

If someone already acted, make rapid reporting easier than concealment. Contact the appropriate internal response team through a trusted route. If a payment was initiated, the authorized finance team should promptly contact its financial institution using established channels. Preserve relevant messages, transaction details, and call information in the approved investigation system.

Avoid claiming that recovery is guaranteed or that every suspicious call is AI-generated. Investigators should distinguish confirmed actions from assumptions about technique. The durable lesson is operational: give employees a clear way to slow down a consequential request without being punished for protecting the organization.