Deepfake attacks are outpacing legacy security controls

At a glance

What this is: Pindrop says deepfake and AI-backed impersonation are turning real-time calls and meetings into identity checkpoints that legacy security tools cannot reliably verify.

Why it matters: This matters because IAM and fraud teams now have to govern identity assurance in live communication channels, where visual and vocal trust cues can no longer be treated as evidence.

By the numbers:

• 93% of security leaders are at least somewhat concerned about deepfake attacks.
• only 10% have invested in a solution
• AI attacks had jumped by 1210%

Context

Deepfake attacks are a governance problem as much as a fraud problem. When a voice call or video meeting becomes a verification point, the organisation is no longer protecting a channel alone. It is trying to prove that the person at the other end is real, which is a very different identity assurance requirement from traditional perimeter security.

Pindrop's data shows a sharp mismatch between concern and action. Leaders say they are worried, but investment in purpose-built defenses remains limited, which leaves real-time communication channels exposed to impersonation that legacy tools were never designed to assess.

The article argues that this is not a point-solution issue. The underlying control gap is continuous trust verification in live channels, where attackers can exploit the absence of identity checks long before a human reviewer notices anything unusual.

Key questions

Q: What breaks when organisations trust caller ID or voice as proof of identity?

A: Caller ID and voice are no longer reliable identity signals because both can be spoofed or cloned. When organisations trust them, attackers can pressure staff into revealing MFA codes, approving payments, or granting access. The failure is not employee negligence alone. It is a control design issue that treats an unverified communication channel as authentication.

Q: Why do real-time communication channels create higher impersonation risk than standard email or ticket workflows?

A: Because the attacker can exploit urgency, authority, and familiarity inside an interaction that feels immediate and personal. That makes it easier to bypass caution, especially when staff believe they are speaking to a known executive, colleague, or customer. The risk grows when the process allows action before independent validation.

Q: How can security teams detect deepfake attacks?

A: Security teams detect deepfake attacks by combining technical checks with process controls. Look for mismatched audio and video cues, abnormal request patterns, and identity verification failures that appear during calls or media exchanges. Use step-up verification for high-risk actions, train staff to challenge urgent requests, and preserve samples for forensic comparison when impersonation is suspected.

Q: What should organisations do first to reduce AI impersonation risk in live calls?

A: Start by identifying which business processes depend on real-time communication for approval, payment, or account change. Then add a separate verification method for those workflows before any action is taken. The first priority is to remove the assumption that a familiar voice is enough.

Technical breakdown

Why real-time channels are now identity checkpoints

Video calls and phone calls were built for communication, not identity proofing. Deepfake and AI-backed impersonation change that by making the channel itself part of the trust decision, because the usual visual and auditory cues can be manufactured. That creates a new assurance problem: security teams must validate identity in-session, not after the fact. This is closer to continuous verification than to ordinary fraud monitoring. Practical implication: treat live voice and video interactions as governed identity events, not informal communications.

Practical implication: Define who can rely on live-channel identity signals and require a separate verification path for high-risk requests.

Why legacy controls miss synthetic impersonation

Traditional security tools are effective when the attack leaves familiar artefacts such as malware, credential abuse, or suspicious logins. Deepfake fraud often bypasses those assumptions because the malicious step happens inside a trusted conversation. The control failure is not a lack of logging alone, but a lack of channel-specific verification that can challenge the authenticity of the speaker or presenter in real time. Practical implication: security monitoring must shift from endpoint-centric detection to identity assurance at the moment of interaction.

Practical implication: Add independent verification steps for financial, administrative, and support actions initiated through voice or video.

Why point solutions do not close the trust gap

A single deepfake detection tool can help, but it does not solve the larger problem if the organisation still treats perception as proof. The article's core point is that AI has altered what counts as evidence, so the security strategy must evolve with it. That means linking detection, policy, escalation, and user workflow into one governed control plane for real-time trust. Practical implication: evaluate the full decision path, not just the detection layer.

Practical implication: Map how a failed authenticity check escalates to human review, transaction hold, or call termination.

Threat narrative

Attacker objective: The attacker wants to induce a trusted person to authorise actions or share information that the organisation would never grant to an unverified identity.

1. Entry occurs through a real-time communication channel such as a video meeting or phone call where attackers present a synthetic voice or face.
2. Credential or authority abuse follows when the target accepts the impersonation and discloses sensitive information or approves a high-risk action.
3. Impact occurs when fraudsters use that trust to move money, redirect processes, or gain broader access to business systems.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Deepfake risk is now an identity assurance problem, not a media-authenticity problem. Once real-time calls become decision points, the organisation is asking identity controls to operate inside a channel that was never built to prove personhood. That changes the governance question from whether a recording looks fake to whether a live interaction deserves trust at all. The practitioner conclusion is that communication channels with business authority need explicit identity policy.

Continuous verification is the missing control concept for live-channel trust. Security teams have spent years hardening endpoints and accounts, but deepfake attacks exploit the space between those controls and the human who still believes what they hear or see. The named concept here is identity checkpoint drift: the channel becomes a gate without any governed assurance standard. The practitioner conclusion is that high-risk interactions need runtime authenticity checks, not only after-the-fact investigation.

Purpose-built deepfake defenses will expose a boardroom prioritization gap before they expose a technical gap. The article's 93% concern figure and 10% investment figure show that awareness is outrunning action. That mismatch is important because fraud teams, IAM teams, and business owners all assume somebody else owns the trust problem. The practitioner conclusion is that ownership for real-time identity assurance must be explicit, or nothing changes operationally.

Deepfake impersonation is a lifecycle issue for trust, not just a fraud event. The same governance discipline that applies to privileged access should apply to live authorisation moments: who may approve, what can be approved, and what proof is required before action proceeds. This is where human IAM, fraud controls, and identity governance intersect. The practitioner conclusion is that organisations need formal lifecycle rules for high-risk approvals made over voice or video.

25% losing $1 million or more shows the blast radius is already material. Even when teams are not dealing with full-scale compromise, synthetic impersonation can create high-value losses through a single trusted interaction. That makes the control objective less about catching every fake and more about limiting how far one successful impersonation can travel. The practitioner conclusion is to design containment around transaction size, authority level, and channel sensitivity.

From our research library:

• According to a recent Gartner report, 40% of government organizations are expected to establish dedicated trust operations functions by 2028 to combat deepfakes.

What this signals

Identity checkpoint drift: when a live call becomes a business gate, the organisation needs a governed authenticity standard for the interaction itself. That shifts responsibility from the network or endpoint layer to the moment of authorisation, where fraud can happen before any classical security control has time to react.

Deepfake impersonation also exposes a trust-decision gap between security teams and business operators. The people approving payments, account changes, or privileged actions need a defined challenge process, otherwise the control plane remains too far from the point of decision.

For practitioners

• Implement channel-specific identity verification Require a secondary proof step for high-risk requests made over video or phone, especially those involving payments, account changes, or privileged approvals.
• Separate conversational trust from authorisation Make sure no business process treats voice recognition, video presence, or familiar behaviour as sufficient evidence for releasing funds or changing records.
• Create escalation rules for synthetic-media suspicion Route any suspected impersonation to an independent reviewer before the request can proceed, and document the approval chain for auditability.
• Limit high-risk approvals by channel Block or constrain major financial and privileged requests that originate only from real-time communication channels without corroborating evidence.
• Measure trust losses by interaction type Track where impersonation attempts land, which channels carry the highest-value approvals, and whether controls are actually reducing exposure.

Key takeaways

• Deepfake and AI-backed impersonation now target the trust layer inside real-time communication, not just the technical perimeter.
• The article's figures show a wide gap between concern and implementation, which leaves organisations exposed to high-value fraud through live channels.
• The practical response is to govern authorisation in the channel itself, with independent verification before sensitive actions are approved.

Key terms

• Deepfake-based impersonation: A fraud technique that uses synthetic audio, video, or both to make an attacker appear to be a trusted person during a live interaction. The tactic exploits human trust in familiar cues and often aims to trigger urgent actions such as payments, resets, or access changes before verification is challenged.
• Real-Time Identity Checkpoint: A communication moment that effectively becomes an authorisation gate, such as a phone call or video meeting used to approve action. When this happens, the channel must be treated as part of identity governance, not just as a collaboration tool.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Identity Checkpoint Drift: The condition where a routine communication channel quietly turns into a trusted decision point without the controls that a formal gate would require. It creates a mismatch between how the channel is used and how the organisation governs risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.