Topic starter
19/08/2026 3:48 pm
TL;DR: Social engineering in financial services is now driven by AI voice cloning, deepfake video, hyper-personalised BEC, vishing and third-party impersonation, with Verizon DBIR data showing 87% of breaches in the sector involved a human element, according to Sprocket Security. The perimeter is not the problem; continuous human-layer testing, callback verification and third-party attack-path review are now the governance controls that matter.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “What the Latest Social Engineering Attacks in Financial Services Look Like”.
Key questions
Q: What breaks when security awareness training is limited to annual compliance modules?
A: Annual compliance modules usually fail because they are static, generic, and disconnected from day-to-day behavior.
Q: Why do AI voice clones and deepfake calls increase wire-fraud risk in finance?
A: They increase risk because they remove the normal cues employees use to judge authenticity, while adding urgency and authority.
Q: What signs show that a financial services social engineering program is failing?
A: Warning signs include one-time phishing metrics, no testing of help desk or treasury workflows, weak callback discipline, and no coverage of third-party impersonation.
Practitioner guidance
- Implement mandatory callback verification for high-risk requests Require independent validation before wire transfers, credential resets, payroll changes, and regulator-sensitive disclosures.
- Test treasury and help desk against AI impersonation Run live scenarios that include cloned voice, deepfake video, and urgent executive pretexts against the teams most likely to approve exceptions.
- Map third-party attack paths into core processes Identify vendors, brokers, law firms, and managed providers whose identities can credibly be used to request sensitive access or information.
Bottom line: Financial services social engineering now exploits human verification gaps more effectively than technical perimeter weaknesses, especially where executive authority, urgency, and vendor trust intersect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:25 pm
Financial services social engineering is now a continuous verification problem, not a training problem. Awareness campaigns assume people can remember and apply static rules when confronted with a novel pretext. That assumption fails when attackers use AI voice cloning, real executive imagery, and current business context to create believable pressure. The control gap is not knowledge alone, but whether the organisation can force verification at the point of action.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: Should financial institutions prioritise human verification over more phishing training?
A: Yes. Training helps people recognise obvious scams, but it does not stop a convincing impersonation that uses current business context and executive authority. Human verification controls, such as callback checks and escalation rules, reduce the chance that a single conversation turns into an irreversible action. Training supports the control, but cannot replace it.
👉 Read our full editorial: Social engineering in finance is now a continuous testing problem