Deepfake Readiness Drills: Test Your Verification Process Before a Cloned Voice Does

It's Friday afternoon and the "CFO" calls. She's travelling, the line is bad, a deal closes Monday and a supplier payment has to go out today. The wire details follow by email ten minutes later. Everything sounds right. That's the problem.

Voice cloning and real-time face swapping have moved deepfake fraud from conference demos into incident reports. The fix isn't training people to spot fakes by ear. It's making sure a fixed verification step happens every time, and then rehearsing it under pressure before an attacker does it for you.

What's changing

• In a 2025 Gartner survey of 302 cybersecurity leaders, 62% said their organization had faced at least one deepfake attack in the previous 12 months. 43% reported a deepfake audio call and 37% a deepfake on a video call.
• In May 2025 the FBI warned about AI-generated voice messages impersonating senior US officials. It noted that cloned voices can be almost indistinguishable from the real person and advised confirming identity through an independently sourced phone number.
• A January 2026 Osterman Research study of 128 US security and IT leaders found that 60% weren't confident they could counter deepfake attacks with the training they already run. (IRONSCALES, an email-security vendor, commissioned the study, so read it as directional.)
• FinCEN has issued an alert on deepfake-enabled fraud. One red flag it highlights is a caller who switches communication channels mid-conversation and blames "technical glitches."

Why it matters

A fraudulent wire is the obvious outcome. The quieter ones do more damage:

• Help-desk MFA resets. A cloned voice asking to move an MFA token to a "new phone" is a fast route to account takeover.
• Privilege grants. A convincing "IT director" asking an identity admin to add a contractor to a privileged group can plant access that sits unnoticed for months. A bad payment at least turns up at reconciliation.
• Vendor bank-detail changes. These redirect legitimate payments to attacker-controlled accounts.

Detection by ear gets less reliable with every model release, so the defence has to rest on process. If the same verification step fires every time money, credentials or permissions are involved, the quality of the fake stops mattering.

What to do: a six-step drill

1. Map who would be faked and who would be called

Build two short lists. The first covers the people an attacker would impersonate: the C-suite, general counsel, and the finance, IT and HR directors whose requests feel routine. Add external contacts with real authority, such as a key supplier's AR lead or your MSP engineer. The second covers the people an attacker would call: AP, treasury, payroll, HR, executive assistants, the IT help desk and identity admins. Help desks and identity admins are the ones most often left off.

Note how much public audio and video exists for each name on the first list. A few minutes from one webinar can be enough to clone a voice.

2. Write the rules before you test them

A drill without a written rule only measures instinct. Define:

• Out-of-band callback for any payment, bank-detail change, credential share, MFA reset or access change. Use a number from the internal directory or vendor master file, never one supplied in the request.
• Fixed thresholds that always require verification, no matter who asks or how urgent it sounds.
• Dual approval for new payees, changed bank details, new privileged accounts and role changes.
• Rotating challenge phrases between the most-impersonated executives and their support staff.
• No-blame reporting, so anyone who already acted on a suspicious request reports it immediately.
• Written permission to pause. Leadership states in writing that nobody gets in trouble for hanging up and calling back. Urgency and hierarchy are what deepfake fraud runs on.

3. Design realistic, multi-channel scenarios

Real attacks usually open with an email or chat message and then escalate to voice or video. First get sign-off from legal, HR and every executive whose identity you'll use. Use a consenting executive's voice, a clearly labelled synthetic stand-in, or a scripted actor. Good starter scenarios:

1. An urgent "acquisition" wire from the CFO: spoofed email followed by a voicemail.
2. A supplier bank-detail change followed by a Teams call from the "vendor".
3. A help-desk MFA move for a "locked-out, travelling" executive.
4. An "access cleanup" that hides one privileged-group addition inside legitimate removals.

Time the scenarios around real pressure points such as quarter close, audit season, pre-holiday days and known executive travel.

4. Run it in stages

Start with a tabletop exercise. It surfaces policy gaps cheaply, and someone usually discovers that nobody knows which number to call back. Then move to live simulations with a small group:

• Brief a small control group (sponsor, SOC lead, head of finance) so the drill doesn't trigger a real incident response.
• Keep real money and access out of reach. Use test payees, approvals that stop short of execution, and sandbox groups.
• Define stop conditions and debrief participants immediately if they become distressed.
• Always tell participants afterwards.

5. Measure behaviour, not just pass/fail

Track the verification rate, time to escalation, whether the report reached the SOC through the right channel, the exact break point, whether bundled requests were questioned, and which trust signals people cite ("it sounded exactly like him" and "the email came first" call for different fixes). Spend most of your effort on the break points, because each one maps to a concrete fix in policy, tooling or training.

6. Debrief, fix, repeat

Debrief the same day and keep it blameless. Update the callback directory, tighten thresholds, and fold the scenarios into your regular phishing-simulation programme. Repeat at least twice a year and whenever the high-exposure list changes, for example after a new CFO, an acquisition or a busy conference season.

Where technology helps

Process carries most of the load. Tooling helps at two points:

• The setup message. Behavioural email security that flags unusual requests from executives or vendors can break the chain before the call ever happens.
• The call itself. Real-time identity verification for collaboration platforms can warn participants when a speaker doesn't match the claimed identity. Before you deploy one, check whether it records or transcribes meetings or only processes signals in the moment.

4Tify takeaway

A first drill needs no budget line. Two lists, one page of verification rules, four scenarios and a debrief template are enough to show where you really stand. If your controls assume people can hear a fake, assume they can't. Test the callback rule instead, and when the "CFO" blames a bad connection, hang up and call back.

Based on reporting by The Hacker News (vendor-contributed article by IRONSCALES), rewritten and expanded by the 4Tify Team.