How to test if employees recognize fake voices and video calls

An overview of practical frameworks for testing organizational readiness against deepfake audio and video attacks, covering scam scenarios like payment fraud and verification protocols.

The threat isn't just about a fake payment order. Someone could pretend to be an executive and ask support to restore an employee's access or an administrator to create an account with broad powers.

In a 2025 Gartner survey of 302 cybersecurity leaders, 62% said their organization had experienced at least one such attack in the previous 12 months. 43% reported at least one incident involving a spoof voice call and 37% reported an incident involving a video call. In a January 2026 survey, 60% of 128 U.S. security and IT leaders said they did not feel confident they could deal with such attacks, even with the training they had already received.

First, list who might be targeted.

Make two lists. In the first, include anyone a fraudster could impersonate: senior executives, but also finance, IT, and human resources managers. Add external partners who can approve payments or access changes, such as key suppliers.

In the second list, note those who are likely to accept such a request: employees in payments, payroll, and support, as well as those who can grant or change access rights. The fake voice of an executive might ask, for example, to transfer access to a new phone or create a new administrator account.

READ ALSO

How to control what Chrome and your Google account record

Also note how much recorded or video footage is publicly available of the individuals on the first list. Speeches, online presentations, and videos on social media can be used to copy their voice or image. Even a few minutes of a presentation can be enough, according to the article.

Agree on the rules before the test

Document what each employee should do when asked to send money, change bank details, share login details, restore access, or change permissions.

A basic rule is confirmation from a second, independent channel: the employee calls a number from the company’s internal directory or supplier file, not the number given in the suspicious request. Also define which actions always require confirmation and which require approval from two people. For executives who are more likely to be targeted, a confirmation phrase can be agreed upon that changes regularly.

Make it clear that employees are allowed to stop the process and call back, even if the request seems urgent or comes from a higher-up. If someone realizes they have already followed a suspicious request, they should report it immediately without fear of retribution.

Try realistic scenarios safely

Before using an executive's voice or image, seek approval from the executive, as well as legal and human resources departments. The test can be done with the executive's consent, with a clearly artificial voice, or with an actor following a written script.

Four scenarios cover key risks: an urgent payment request that appears to come from the CFO, a change in supplier bank details confirmed in a Microsoft Teams call, a request from a sales executive to restore access, and a supposed rights review that hides a request to add an external partner to an account with broad powers.

Start with a roundtable discussion so employees can describe what they would do at each step. Then move on to live testing with a small group. Inform a limited number of managers that the exercise is taking place so they don’t mistake a test call for a real incident. Only use test accounts and payment requests that stop before any money is spent. If anyone gets upset or the exercise interferes with regular work, stop it. Always explain to participants afterward that it was a test.

Measure the points where the process didn't work

Don’t just focus on whether someone passed or was cut off. Record whether the intended confirmation was made, how quickly the request was reported, and whether the report reached the security team. Note exactly where the process got stuck: was the correct number missing, the rule unclear, or did the alleged executive pressure the employee to bypass the confirmation?

In the rights-change scenario, consider whether participants noticed the suspicious request hidden within an otherwise logical task. In the post-test discussion, ask what convinced them: the voice, a previous message, or a sense of urgency. These responses indicate what needs to be changed in the rules or training.

Do the discussion without assigning blame and, if possible, on the same day. Explain what was false and what verification step could have revealed the request. Fix what didn’t work and repeat the exercise at least twice a year, and also when the executives or conditions that increase the risk change. Change the scenarios so that employees don’t simply recognize them from the previous test.

In May 2025, the FBI warned that copied voices can look almost identical to the real thing and recommended verification via an independently verified phone number. FinCEN, in its warning about fake image and voice scams, points out a warning sign when a call is switched in the middle of a conversation, citing technical difficulties. In such a case, returning the call to a known number is a simple way to verify the claim.

Tools that check for unusual messages or calls can add another layer of protection, but testing must first verify that people are following the agreed-upon rules. IRONSCALES says its protection for Microsoft Teams meetings compares voice and facial features without keeping audio recordings or transcripts. The company recommends carefully examining what data any such tool records or retains.

G

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr