Deepfake impersonation is changing trust: what should teams do?

TL;DR: AI-generated voice, video and writing have made familiar trust signals unreliable, according to Doppel, with 99.9% of people unable to tell an AI voice clone from a real one and 62% of organisations already targeted by deepfake attacks. The control problem has shifted from spotting fakes to enforcing repeatable verification before high-risk action.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Some Assembly Required: Verifying What's Real in 2026”.

By the numbers:

• 99.9% of people can't reliably distinguish an AI-generated voice clone from a real one.
• Across 100 AI voice-clone calls impersonating a CISO, every single employee believed it was real for an average of 6 minutes.
• 62% of organisations have already been targeted by a deepfake attack.

Key questions

Q: How should security teams handle human verification when voice and video can be faked?

A: Treat voice and video as untrusted indicators, not proof.

Q: Why do awareness programmes fail against deepfake and synthetic phishing attacks?

A: They fail when they rely on recognition rather than verification.

Q: What are the signs that social engineering controls are not keeping up with AI impersonation?

A: Repeated urgent requests, cross-channel inconsistencies, help desk overrides and approval decisions made without secondary verification are all warning signs.

Practitioner guidance

• Define high-risk request categories Classify resets, wire approvals, executive requests, vendor bank-detail changes and token resets as actions that require verification beyond the initial message.
• Add out-of-band confirmation steps Require a second channel or callback using independently sourced contact details before any privileged or financial action is completed.
• Harden help desk and service workflows Make support staff verify identity through policy-driven steps before account recovery, MFA changes or delegated access changes are approved.

Bottom line: AI-generated voice, video and text have made traditional trust cues too weak to serve as a reliable security boundary.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →