Cloned voices and synthetic video calls are no longer confined to academic discussions; they are actively appearing in payment fraud, help desk resets, and access requests. A structured drill can reveal precisely where verification processes break down, all without real-world stakes. Consider the scenario: a call comes in late on a Friday, seemingly from the CFO, urging an urgent supplier payment. The voice is identical, the connection poor, the tone rushed. Minutes later, an email with wire details arrives. A couple of years ago, this was a hypothetical; today, it's a documented incident. A **2025 Gartner** survey of 302 cybersecurity leaders revealed that 62% of organizations experienced at least one deepfake attack in the prior 12 months. Specifically, 43% reported deepfake audio call incidents, and 37% encountered deepfakes on video calls. Beyond wire fraud, a cloned voice can manipulate a help desk into moving an **MFA** token or an identity administrator into creating a new global admin account. While fraudulent wires are often detected during reconciliation, a quietly added admin account can persist for months, providing persistent access to an attacker. Most organizations have policies for verifying unusual payment and access requests. However, fewer have tested whether these policies hold up against a convincing deepfake from a senior executive. A deepfake readiness drill allows organizations to identify these vulnerabilities proactively and safely. ## Why Detection by Ear Falls Short Traditional security awareness training emphasizes looking for anomalies like awkward phrasing or suspicious sender addresses. However, modern voice clones and real-time face swaps leave fewer such indicators. Relying on an employee's ability to discern a fake voice is increasingly unreliable. In May 2025, the **FBI** issued a warning regarding **AI**-generated voice messages impersonating senior US officials, noting that cloned voices can sound nearly identical to the real person. The **FBI** advised recipients to confirm identities by calling an independently sourced phone number before acting on any requests. Security leaders acknowledge this challenge. A January 2026 **Osterman Research** study, commissioned by **IRONSCALES**, found that 60% of 128 US security and IT leaders lacked confidence in their ability to counter deepfake attacks, even with existing training. This underscores the need for process-based defenses over perception-based ones. If employees consistently follow verification steps for any financial, credential, or permission-related requests, the quality of the deepfake becomes less relevant. Drills test whether these critical steps are followed, especially under pressure from a seemingly senior voice. ## Step 1: Map the Voices Worth Cloning and the People Worth Calling Begin by creating two concise lists: * **Target Impersonations:** Executives who can approve payments or direct staff (e.g., **CEO**, **CFO**, **CIO**, **CISO**, General Counsel). Also include VPs and directors in finance, IT, and HR, as their requests are more common and thus less suspicious. Don't forget external contacts with authority over money or access, such as key supplier contacts or **MSP** engineers. * **Target Recipients:** Roles such as Accounts Payable, Treasury, Payroll, HR, Executive Assistants, the IT Help Desk, and anyone who can grant or modify access in your identity platform. The help desk and identity admins are often overlooked but are critical targets for **Account Takeover (ATO)** via **MFA** resets or new admin account requests. For each individual on the first list, assess the amount of publicly available audio and video (e.g., earnings calls, podcasts, conference keynotes, webinars, social media). Even a few minutes from a single webinar can provide enough material for a convincing deepfake. This step yields a matrix of high-value targets for impersonation and the individuals most likely to receive their fraudulent calls – typically a manageable few dozen people. ## Step 2: Write the Verification Rules Before Testing Them A drill without clear rules only measures instinct. Before any scenario, document the expected employee actions. Strong verification rules typically include: * **Out-of-band callback:** Any request involving money transfers, bank detail changes, credential sharing, **MFA** resets, or access modifications must be confirmed via a number from an internal directory or vendor master file, never a number provided in the request itself. * **Clear thresholds:** Explicitly define which actions always require verification, regardless of the requester or perceived urgency. * **Dual approval:** Mandate two-person sign-off for new payees, altered banking details, new privileged accounts, and role changes. * **Challenge phrases:** For highly impersonated executives and their direct support staff, implement a rotating challenge phrase. * **No-blame reporting:** Establish a culture where employees can report suspicious requests they've already acted upon without fear of reprisal. Shaming discourages reporting, allowing attackers to continue their operations undetected. * **Explicit permission to pause:** Senior leadership (e.g., **CEO**, **CFO**) must clearly communicate in writing that employees will not face negative consequences for pausing a request to verify it. Deepfake fraud thrives on urgency and hierarchy; empowering employees to trust their instincts and take a minute to verify is crucial. ## Step 3: Design Multi-Channel Scenarios Real-world attacks rarely involve a single phone call; they often begin with email or chat to establish context, then escalate to voice or video for pressure. Drill scenarios should mirror this multi-channel approach. Crucially, secure sign-off from legal, HR, and any executive whose identity will be used. Cloning a voice without consent presents its own legal and ethical challenges. Many teams opt for a consenting executive's voice, a clearly labeled synthetic stand-in, or a live actor working from a script. Four starter scenarios cover common risks: 1. **Urgent wire from the CFO:** A spoofed email flags a confidential acquisition payment, followed by a voicemail in the **CFO**'s voice asking the controller to process it before end of day. 2. **Supplier bank change:** A message from a known vendor contact announces new banking details, followed by a **Microsoft Teams** call from the "vendor" to confirm the update. 3. **Help desk reset:** A caller sounding exactly like the **VP** of sales claims to be traveling, locked out, and needs **MFA** moved to a new phone before a board meeting. 4. **Access cleanup:** An email from the **CISO**'s office announces a quarterly permissions review. A **Teams** call from the "IT director" then walks an identity admin through the process: stripping excess rights from five users and, subtly, adding a contractor account to a privileged group for "auditors." The cleanup provides cover for the malicious addition. Time these scenarios to coincide with typical pressure points attackers exploit, such as quarter-end, audit season, days before holidays, or periods when executives are publicly known to be traveling. ## Step 4: Run It in Stages Begin with a tabletop exercise. Guide the target group through each scenario in a conference room, asking what they would do at each step. This cost-effectively reveals policy gaps (e.g., confusion over which number to call for verification). Next, move to live simulations with a small, controlled group. Key ground rules for safety: * **Brief a small control group:** The executive sponsor, **SOC** lead, and head of finance should be aware of the drill to prevent a real incident response from being triggered. * **Keep money and access out of reach:** Use a test payee, a payment request that halts at the approval stage, and a sandbox group with no real privileges. No real assets should ever be at risk during the drill.