Deepfake Fraud and Voice-Clone Vishing: When Seeing Is No Longer Believing

Deepfake-enabled fraud is the synthetic-media layer on top of classic business email compromise and vishing. Attackers synthesise an executive’s or relative’s face and voice from publicly available video and audio — earnings calls, conference talks, social media — then deploy it on a live video or phone call to authorise a fraudulent wire transfer or extract credentials. The deepfake supplies the “proof” that defeats the victim’s skepticism. A closely related use: real-time face-swap deepfakes that help fraudulent DPRK IT workers pass live job-interview identity checks.

How It Works

The attacker trains a voice or face model on the target’s public media, then uses it in real time to impersonate a trusted person — a CFO instructing a transfer, or a “family member” in distress. It is social engineering with a synthetic identity: the technique layers onto spearphishing-by-voice and impersonation rather than replacing them. T1566.004 T1656 T1598

A Note on Mapping

Deepfake abuse maps to MITRE ATT&CK impersonation and phishing techniques (T1656, T1566.004, T1585 for the IT-worker persona), but “deepfake” is not a dedicated ATT&CK technique — it is an enabling method. It does not belong in MITRE ATLAS: ATLAS covers attacks on AI systems, not AI used to attack people. We keep that distinction explicit.

Detection & Mitigation

• Out-of-band verification: call back on a known-good number for any payment or sensitive-data request, no matter how convincing the caller looks or sounds.
• Require dual authorisation and transaction limits for wire transfers; no single-person large-value approvals.
• Agree verbal challenge phrases or code words for executives and family members.
• Harden hiring: liveness detection, government-ID plus live match, camera-on with on-the-spot physical actions, and awareness of lip-sync/audio desync tells.
• Train the workforce that video and voice are no longer proof of identity.