Vishing is phishing that arrives as a phone call, and I wrote about the passkey-enrollment version of it in an earlier post. This is the next turn of the same screw. The caller is no longer just a convincing stranger reading a script, the caller now looks and sounds like someone you actually report to, because the face on the video tile and the voice in your ear were generated from footage that executive published themselves.
The uncomfortable part is how little raw material it takes. A keynote on a conference YouTube channel, a few minutes of a quarterly earnings call, a podcast appearance, any of it is enough to train a voice clone that lands the cadence and the accent, and the video side has caught up to the point where a real-time face swap survives a short call on a laptop camera. When scammers targeted WPP, the largest advertising company in the world, they built the fake from a public image of the CEO and YouTube footage of him and ran it inside a Microsoft Teams meeting. Nobody had to breach anything to get the training data. The executive handed it over the moment they went on stage, which is not a criticism of going on stage, it is just the new cost of being a public face for a company.
I am deliberately not going to walk through how to assemble one of these, partly because the point does not need it and partly because the recipe is not really the interesting part anymore. What is interesting is that the technique has moved from nation-state budgets to commodity tooling in about two years, while the defenses most organizations rely on were built for a threat model where the person on the call is at least a real person.
Why your instincts stop helping
Security awareness training spent a decade teaching people to distrust the written word. Check the sender address, hover the link, look for the odd grammar. Almost none of that training prepared anyone to distrust a live human face saying a plausible thing in a voice they recognize.
A deepfake call attacks the one channel people were told they could trust. The whole reason a phone or video call carries weight inside a company is that it is supposed to be harder to fake than an email, so when a request comes with a face and a voice attached, the recipient tends to drop the scrutiny they would have applied to a message. That is the mechanism. The attacker is not defeating a control, they are borrowing your own trust in a familiar person and spending it before you think to check.
And the requests are usually mundane on purpose. Approve this transfer before the market opens. Sign this NDA, the deal is confidential and the regulator has already been told. Help me get this new hire set up, I am between flights. The scenario is built to feel like a normal Tuesday with a little urgency layered on top, because urgency is what stops people from picking up a second phone and calling back.
This is already happening
The clearest case is the engineering firm Arup. A finance employee in the Hong Kong office joined a video call where the CFO and several colleagues were present, discussed a confidential transaction, and over the following days made fifteen transfers totalling roughly twenty five million dollars to five bank accounts. Every participant on that call except the victim was an AI generated deepfake. The fraud only surfaced when the employee later checked in with headquarters about the secret transaction and was told no such meeting had ever happened. As of the reporting, none of the money came back.
The attempts that failed are just as instructive, because they show where the technique breaks. In April 2024 a LastPass employee received WhatsApp calls, texts and a voicemail using a deepfaked voice of the company's CEO, and ignored all of it because the CEO does not contact staff over WhatsApp and the message leaned on urgency, two signals that had nothing to do with how good the audio was. Around the same window a Ferrari executive got WhatsApp messages in a convincing clone of CEO Benedetto Vigna's voice, and ended the call by asking a question only the real Vigna could answer, the title of a book he had recommended days earlier, at which point the caller hung up. And the WPP attempt I mentioned above went nowhere for similar reasons.
The pattern across the failures is worth sitting with. Not one of them was caught because someone spotted a rendering glitch or heard a robotic note in the voice. In each case the defense was a procedure the person followed, moving the conversation to a channel the attacker did not control or asking for something the attacker could not fake, rather than a judgment call about whether the video looked right.
The payoff is usually a change to your identity layer
For a finance target the deepfake ends in a wire transfer, and that is the story that makes headlines. For most organizations the more likely target is the help desk or an administrator, and the payoff is quieter. A convincing call to IT gets a password reset, or an MFA factor removed and re enrolled, or a new admin added as a favour to a stressed out executive who is travelling. This is the same terrain the Scattered Spider crews walked at MGM and Caesars, except the caller now has a face.
Once that access lands, what happens next looks exactly like the aftermath I described in the earlier post. Someone adjusts an authentication policy, widens a network zone, grants a role, mints an API token, adds themselves to a group that quietly carries an application assignment. None of it trips an alarm, because from the identity provider's side an authorized session did authorized things, and all of it outlives the password reset you do once you realize the call was fake. So the question the deepfake eventually forces is the same one every identity incident forces, which is what changed while they were in there, and whether you can prove it.
What actually defends against this
The good news in the failed attempts is that the working defenses are cheap and human, and they do not depend on anyone being able to spot a fake in real time, which is a skill I would not bet a payroll on.
Move the request to a channel you control before you act on it. If a call asks for money, credentials, MFA changes or access, hang up and call the person back on a number you already have, or reach them on the internal system you both use every day. An attacker can spoof the inbound channel, they have a much harder time answering the phone number already sitting in your own directory.
Agree on out of band verification for sensitive actions in advance. A shared challenge phrase for executives, a mandatory second approver for transfers over a threshold, a rule that MFA resets never happen on a single inbound call. Ferrari's book question worked because the real relationship carried context the attacker did not have, and you can make that repeatable instead of lucky.
Harden the help desk specifically, because it is the softest identity target in most companies. Callers requesting resets or factor changes should be verified through something stronger than knowledge an attacker can scrape from LinkedIn, and the people staffing that desk should have explicit permission to slow down and verify without it counting against them, even when the caller sounds like the CEO and says it is urgent.
And assume one of these eventually works, because the base rate says it will, and make sure you can answer the after question. That means keeping a current, restorable record of your identity configuration, so that when the incident is contained you can compare the org to its known good state, see every policy, role, group membership and factor that moved, and put it back. This is the part Butterfly Security exists to handle for Okta, Okta Workflows and Auth0, capturing the full configuration on a schedule so the diff after an incident is a lookup rather than an archaeology project.
The question to leave with your team
Run the drill as a conversation, not a tabletop. Ask the finance lead what they would do if the CFO joined a video call and asked them to move money before the market opened. Ask the help desk what happens when someone who sounds exactly like an executive calls in a hurry needing a factor reset. If the honest answer is that they would probably comply because the voice was right and the person was senior and the moment was tense, then the fix is not sharper eyesight or a better ear for a fake, it is a rule that takes the decision off the call and onto a channel you own, plus a way to recover if the call ever wins anyway.