Topic starter
06/11/2026 6:38 pm
TL;DR: Deepfake attacks are now used for executive impersonation, helpdesk social engineering, voice cloning fraud and MFA bypass, according to Admin By Request, and Gartner data cited in the piece points to 43% of cybersecurity leaders seeing audio incidents and 62% seeing deepfake attacks within 12 months. Identity processes that assume humans can reliably validate voice or face are losing their reliability.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “How Deepfakes Are Being Used in Cyberattacks (And What to Do About It)”.
Key questions
Q: How should organisations verify requests when deepfakes can imitate trusted people?
A: Organisations should require a second, authenticated channel for any high-impact request.
Q: What should teams do first when a helpdesk reset request may be synthetic?
A: Pause the reset and move the request into a stronger verification path before any credentials are changed.
Q: How does deepfake-assisted social engineering lead to account takeover?
A: Attackers use synthetic voice or video to impersonate a trusted executive, colleague, or support contact and trick the target into resetting a password, approving MFA, or revealing one-time codes.
Practitioner guidance
- Tighten helpdesk reset verification Require stronger proof for password resets, MFA re-enrolment and account recovery, including out-of-band callbacks and physical identity checks for higher-risk changes.
- Separate approval from the request channel Make payment approval, access grants and sensitive data requests require confirmation in a second channel that the requester did not use to make the ask.
- Replace standing privilege with JIT access Ensure a successful impersonation yields only the minimum access needed for the account, with elevated rights issued per request and per task.
Bottom line: Deepfake attacks succeed when organisations let voice, video and urgency substitute for stronger identity verification.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Deepfake fraud is now an identity governance problem, not just a fraud problem. The control failure is not limited to recognising a fake voice or face. It is the assumption that a human can safely authorise high-risk identity changes from a single conversational channel. Once that assumption breaks, helpdesk reset flows, payment approvals and executive requests all become identity attack surfaces.
A few things that frame the scale:
- Veriff's 2026 Identity Fraud Report documented a 300X increase in digitally presented media that was either entirely AI-generated or otherwise altered.
A question worth separating out:
Q: Why do deepfakes create fraud risk even when MFA is already deployed?
A: MFA protects system access, not human trust inside a live conversation. A fraudster can pass the login boundary and still impersonate a colleague on a call or video meeting. That is why organisations need a second assurance layer for communication-time identity, especially where approvals or transfers can happen outside applications.
👉 Read our full editorial: Deepfake attacks are collapsing trust in identity workflows