Deepfake readiness drills put payment and access checks to the test

Cloned voices and synthetic video calls are increasingly being used to request supplier payments, MFA resets and privileged-account changes. A 2025 Gartner survey of 302 cybersecurity leaders found that 62% had experienced at least one deepfake attack during the preceding 12 months; 43% reported deepfake audio-call incidents and 37% encountered deepfakes in video calls.

The immediate target may be a wire transfer, but the same technique can be used against a help desk or identity administrator. A caller impersonating an executive may seek to move an MFA token or create a global administrator account. Those access changes can be harder to detect than a fraudulent payment.

Test verification, not employees' hearing

Voice and face-generation tools leave fewer obvious clues as they improve. The FBI warned in May 2025 that AI-generated messages impersonating senior US officials could sound nearly identical to the real person. Its advice was to confirm identity through an independently sourced telephone number before acting.

That makes a readiness drill a test of procedure rather than an audition in spotting artificial speech. Before a drill, organisations should specify which actions always require an out-of-band callback: moving money, changing bank details, sharing credentials, resetting MFA or altering access. The callback number should come from an internal directory or vendor master file, never from the request itself.

Rules can also require dual approval for new payees, changed banking details, privileged accounts and role changes. Challenge phrases that are shared and rotated by frequently impersonated executives and their support staff add another control. Senior leaders should explicitly state that staff may pause, hang up and verify a request without adverse consequences.

Build scenarios around the real attack path

A useful exercise first maps the identities an attacker is likely to imitate, including executives, finance, IT and HR leaders, as well as authorised external contacts. It also identifies likely recipients: accounts payable, treasury, payroll, executive assistants, help-desk staff and identity administrators. Public earnings calls, webinars, podcasts and social clips can provide material for a voice clone.

Scenarios should reflect the multi-channel nature of fraud. An email or chat message may establish context before a voice or video call applies urgency. Examples include an alleged CFO payment request, a supplier bank-account change, a travelling executive asking for an MFA reset, or a permissions review containing a concealed request to add an account to a privileged group.

Legal, HR and each executive whose identity is involved should approve the simulation in advance. Teams can use a consenting executive, a clearly labelled synthetic stand-in or a live actor. The exercise should begin with a tabletop discussion, then move to a small live simulation with a control group aware that it is running. Test payees, payment requests that stop at approval and sandbox groups with no real privileges keep money and access out of reach.

Measure failures and make targeted fixes

A pass-or-fail score reveals less than the behaviour behind it. Teams should measure the share of participants who completed the documented callback or challenge step, the time taken to escalate, the channel used to report, and the precise step where the workflow failed. They should also examine whether staff questioned a risky addition hidden among legitimate access-cleanup tasks.

Debriefs should be prompt and blameless, followed by practical changes such as correcting callback directories, clarifying thresholds and incorporating scenarios into regular phishing simulations. Repeating drills at least twice a year, and whenever exposure changes through a new executive, acquisition or public speaking activity, gives businesses a way to verify that payment and identity controls still work when urgency and hierarchy are used against them.