A reported account describes a senior banking executive receiving a message that appeared to come from the chief executive, followed by a call in a familiar voice and pressure to move money. The precise details should be treated cautiously because the account is not an official incident investigation, but the control lesson is sound: a known voice cannot be treated as proof of authority. The report also makes the more important point that the human ear is a poor authentication factor.
That matters because voice cloning is no longer an exotic laboratory concern. In early 2024, a finance employee at engineering firm Arup wired about 25 million US dollars after a video call with AI-deepfaked recreations of the CFO and colleagues. Arup CIO Rob Greig described the event as technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email before the deepfake call, which is precisely why the issue belongs in the broader payment workflow, not only in a media-forensics discussion.
The control failure is behavioural
Training employees to “spot” a suspicious voice places too much responsibility on an uncertain signal. The better question is what the employee is permitted to do when a familiar person requests an unusual action.
For a payment approval, beneficiary change, password reset or VIP servicing request, the organisation should be able to show:
- whether the request was recorded and classified as high risk;
- whether the employee used an independent, trusted callback route;
- whether a second person approved the action through a separate channel;
- whether an unusual urgency or secrecy instruction triggered escalation;
- whether payment details were verified against a known record, rather than repeated from the caller.
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that synthetic audio and video can be generated in response to live prompts. Its guidance endorses live verification while making clear that verification alone is not enough. A control that depends on recognising a voice, or on receiving a convincing response to a challenge, needs a stronger process around it.
Voice technology is also becoming ordinary in daily work. A recent practical account of building a software feature using a creator’s own voice illustrates how quickly voice interaction is moving into normal product use, not just fraud scenarios. That account is not evidence of an attack, but it reinforces why familiarity with a voice should not be confused with identity assurance.
Test the workflow, not the employee’s hearing
Per Pindrop’s 2025 report, deepfake voice-fraud attempts rose 1,300 percent in 2024. This is single-vendor telemetry, not a universal measure, but it is a useful warning about direction of travel. Deloitte’s 2024 poll of more than 1,100 C-suite executives found that 25.9 percent said their organisation had experienced one or more deepfake incidents targeting financial or accounting data in the prior 12 months.
The practical response is an authorised assessment. In a two to three week, fixed-scope engagement, DeepBlocker places controlled vishing calls against defined staff and workflows, then returns sealed evidence showing who was fooled, which escalation path was used, and where payment verification broke. The result is evidence a board, insurer or regulator can review, rather than another generic awareness completion report.
DORA Article 26, live since 17 January 2025, explicitly brings people, processes and technologies into threat-led penetration testing and requires ethical boundaries for social engineering. For UK firms, the Payment Systems Regulator’s reimbursement regime has applied since 7 October 2024, with reimbursement of up to £85,000 per Faster Payments scam claim. The case for testing is therefore operational, regulatory and financial.
Subscribe to the DeepBlocker intelligence for evidence-led field notes on voice-fraud readiness.