Seeing and hearing someone is no longer proof that they are there. Generative AI can clone a voice from public recordings and put a convincing face on a video call, and criminals use both to impersonate executives, suppliers, colleagues, job candidates and IT staff. In early 2024 a finance employee at Arup made 15 transfers totalling HK$200 million after a video conference in which, according to Hong Kong police, every other participant was fake. Most impersonation still relies on older tricks too: a call to the help desk, a spoofed email, pressure to skip a process. This guide explains how deepfake and impersonation attacks work, the identity, process and technical controls that stop them, and how to detect and measure them. It is for security, identity, finance, HR and help desk leaders, and for teams deploying AI agents that act on requests from people and other agents.
Key takeaways
- Recognition is not verification: treat voice, video, chat and email as unauthenticated channels, however familiar the face or voice.
- Process beats detection: out-of-band verification through known channels, dual approval and cooling-off periods stop attacks that no detector catches.
- Move trust into identity systems: replace "does this sound like them?" with an approval made with phishing-resistant authentication on the person's registered device or inside an authenticated workflow.
- Help desks, finance and recruiters are the main targets: give them scripts, tooling and explicit permission to slow down and escalate.
- AI agents inherit the problem: agents can be impersonated, can be steered into persuading humans, and need verifiable identities and human confirmation for sensitive actions.
How impersonation attacks work
The attacker gathers material on the person they will pose as, contacts a target with authority to act, and applies urgency or secrecy so the target skips normal checks. MITRE ATT&CK describes this as Impersonation (T1684.001), noting that it is typically preceded by reconnaissance on the victim organisation and that urgent words such as "payment" or "request" are used to push victims to act quickly. Voice variants are tracked as Spearphishing Voice (T1566.004), which ATT&CK notes is often combined with MFA request generation to trick users into accepting prompts.
Generative AI changes the cost and quality of the pretext, not the method. The FBI warned in December 2024 that criminals use generative AI to produce text without the spelling errors that used to give fraud away, fake identity documents, short voice clips of a relative in a crisis, and videos for real-time chats with supposed company executives or other authority figures. FinCEN's November 2024 alert reported an increase, beginning in 2023, in suspicious activity reports describing suspected deepfake media used in fraud against financial institutions and their customers.
| Attack | Target | Typical goal |
|---|---|---|
| Executive impersonation (CEO or CFO fraud) by email, voice or video | Finance staff, executive assistants | Urgent or secret payment to an attacker account |
| Supplier impersonation | Accounts payable | Change of bank details on invoices |
| IT or help desk impersonation (vishing) | Employees | Approve an MFA prompt, install remote access tools, reveal a code |
| Employee impersonation to the help desk | Help desk agents | Password or MFA reset, new device enrolment |
| Deepfake identity verification | Onboarding and recovery flows | Open or take over an account |
| Fake job candidates | Recruiters and hiring managers | Get hired and gain insider access |
| Agent or tool impersonation | AI agents and their users | Inherit trust to run privileged actions |
Email remains a common delivery channel. According to the FBI's 2024 Internet Crime Report, business email compromise drew 21,442 complaints and reported losses of $2,770,151,146 in 2024. See the Email Identity and BEC Guide and the Vishing and Smishing Guide.
Recent examples
In each case the damage was done with the victim's own legitimate access.
| Incident | Who was impersonated | What it achieved |
|---|---|---|
| Arup Deepfake Fraud 2024 | The UK-based CFO and colleagues, on a multi-person video call built from public video and audio, according to Hong Kong police | 15 transfers totalling HK$200 million to five bank accounts; discovered when the worker checked with head office |
| Cisco Breach 2022 | Trusted organisations, in voice phishing calls described by Cisco Talos | An employee accepted an MFA push, giving VPN access; the attacker then enrolled new MFA devices |
| MGM Resorts Breach 2023 | An MGM employee, in a call to the IT help desk, according to the attackers' account relayed by vx-underground | Claimed administrator access to Okta and Azure tenants; MGM estimated a $100 million negative impact |
| Marks and Spencer Cyberattack 2025 | A third-party user, which the M&S chairman told MPs was "sophisticated impersonation" | Ransomware and data theft; M&S estimated a £300 million reduction in profit before recoveries |
| ShinyHunters Salesforce Data Theft Campaign 2025 | IT support, in vishing calls tracked by Google as UNC6040 | Victims approved a modified Data Loader connected app, used to export Salesforce data |
| Storm-2949 Azure Attack 2026 | Activity Microsoft assessed as consistent with self-service password reset abuse, with an IT support pretext given as an example | Users completed MFA prompts; the actor reset passwords, removed authentication methods and enrolled its own authenticator |
In May 2025 the FBI said that since April 2025 actors had impersonated senior US officials using text messages and AI-generated voice messages, often moving targets to another messaging platform to steal account access. In January 2025 the FBI reported that North Korean IT workers had used AI and face-swapping technology during video job interviews to hide their true identities, and that some later extorted employers with stolen code.
Controls that work
Verify through a separate, known channel
- For any request to pay, change bank details, grant access or reset credentials, confirm through a channel the requester did not supply: a call-back to a number from the HR or supplier master file, a message in a verified internal chat, or an approval in a workflow system. The FBI gives the same advice: independently find a number for the person and call to verify.
- Code phrases can help senior staff and their assistants, but never rely on facts an attacker can research.
Use identity, not recognition
- Ask the person to prove themselves with something bound to their identity: a phishing-resistant MFA or passkey approval on their registered device, or a signed request in a workflow tool. CISA's Scattered Spider advisory recommends FIDO/WebAuthn or PKI-based MFA because it resists phishing, push bombing and SIM swap. See the Phishing-Resistant MFA Guide.
- Do not use voice as an authenticator. NIST SP 800-63B-4 states that biometric comparison based on voice shall not be used, so voice-print caller authentication should be retired for sensitive actions.
- For help desk resets, follow the verification methods in the Account Recovery and Help Desk Security Guide.
Build friction into high-risk actions
| Request | Minimum verification | Additional safeguard |
|---|---|---|
| Payment above threshold or to a new payee | Approval by two people inside the payment system, each with strong authentication | No approvals accepted by phone, video, chat or email alone |
| Supplier bank detail change | Call-back to the number held before the request arrived | Cooling-off period and notification to the old account contact |
| Password or MFA reset | Identity verification against the registered device or a manager-confirmed check | Alert the user through the old method; extra scrutiny for privileged and third-party users |
| New device or authenticator enrolment | Existing phishing-resistant factor or in-person check | Review of enrolments that follow a reset |
| Granting a connected app or remote access tool | Admin approval workflow, not end-user consent during a call | Allow-list of approved apps and remote tools |
- Publish a written rule that no executive will ever ask for a secret, urgent payment outside the normal process, so a request like that is itself a red flag.
- Give staff explicit permission to pause, verify and escalate without penalty. The Arup worker first suspected phishing; a policy that backs that instinct is a control. See the Authorised Push Payment (APP) Fraud Guide.
Protect identity verification flows
Remote onboarding and recovery are where deepfakes meet identity systems directly. NIST SP 800-63A-4 notes that many emerging attacks pair digital injection attacks with generative AI to defeat document checks, biometric comparison and visual comparison by proofing agents, and that a biometric comparison alone does not prevent them. It requires presentation attack detection for remote biometric collection and technical controls to detect a virtual camera, device emulator or jailbroken device, and recommends analysing media for signs of known deepfake tools. FinCEN lists a third-party webcam plugin during a live check among its red flags. See the Biometrics Guide, the Identity Proofing and KYC Guide and the Synthetic Identity Fraud Guide.
Protect hiring
- The FBI recommends identity verification during interviewing, onboarding and throughout the employment of any remote worker, and completing as much of hiring and onboarding in person as possible.
- Cross-check HR systems for applicants who share CV content, phone numbers or email addresses, and watch for changes of address or payment platform during onboarding.
- Check that the person who joins is the person who interviewed, and limit new starters' access until verification is complete. See the Insider Threat and Identity Guide.
Email and messaging controls
Enforce DMARC on your own domains, flag look-alike domains and, as CISA's Scattered Spider advisory recommends, add a banner to email from outside the organisation. Label external participants in chat and meetings so a "colleague" from another tenant stands out.
Detection and provenance technology
NIST AI 100-4 (November 2024) splits the technical options into two families: provenance data tracking, which records where content came from, and synthetic content detection, which tries to classify content as synthetic or not.
- Deepfake detection: NIST describes automated detection as "a constant cat-and-mouse game" in which generators improve as soon as a new detection method appears, and notes that detectors often perform best on content from the generators they were trained on. Treat a detector score as one signal, test it on content from generators it has not seen, and never let a "pass" override a process control.
- Content provenance: the C2PA standard attaches a cryptographically signed Content Credential that records an asset's origin and edits. The C2PA explainer is clear that credentials do not judge whether content is true, only whether provenance is intact and signed by a trusted implementation, and that metadata can be removed, which is why it also supports watermark and fingerprint "soft bindings". Provenance helps prove that genuine content is genuine; it cannot prove that unsigned content is fake.
- Meeting controls: restrict who can join sensitive meetings and show verified identity labels, but make the decisive check for a payment or reset outside the call.
Detection and monitoring
Spotting a fake face in real time is unreliable; spotting what the attacker does next is easier. MITRE's detection strategy for Spearphishing Voice is to correlate call activity with what follows: remote management tool installs, MFA push fatigue or unusual consent grants.
| Signal | What it can indicate | Source of the signal |
|---|---|---|
| Password reset followed by removal of authentication methods and a new authenticator | Help desk or self-service reset abuse, as in Storm-2949 | Identity provider audit logs |
| MFA approvals or consent grants shortly after an inbound call | Vishing that walked the user through a prompt | Identity provider logs correlated with telephony or ticket records |
| New remote monitoring and management tool on an endpoint | IT support impersonation, a technique CISA attributes to Scattered Spider | EDR and software inventory |
| Third-party webcam plugin or virtual camera during live verification | Injected or pre-recorded video | Identity verification platform |
| Multiple logins to one account from different countries in a short period | A hired impostor or shared access, which the FBI links to North Korean IT workers | Sign-in logs |
| New payee, bank detail change or urgent payment outside normal hours | Executive or supplier impersonation | Payment system and ERP |
Route these signals to a team that can freeze a payment or revoke a session within minutes. See the ITDR Guide and the Identity Incident Response Playbook.
Training that helps
- Teach the process, not the glitches: the FBI lists visual tells such as distorted hands, irregular faces and call lag, but also warns that AI-generated content is often difficult to identify. The lasting lesson is "we always call back on the known number".
- Train by role: run realistic exercises for finance, help desk agents, executive assistants and recruiters, such as a simulated "CFO" call.
- Reduce the raw material: both the FBI and the NCSC note that criminals use information people post online to make approaches more convincing; executives and their teams should review what voice, video and personal detail they publish.
- Reward reporting, including false alarms, and make the reporting route simple. The NCSC runs public reporting services for scam emails, texts and calls.
See the Security Awareness and Human Risk Management Guide.
AI agents and impersonation
The OWASP Top 10 for Agentic Applications (2026) covers two agent forms of the problem.
- Agents impersonated by attackers: under ASI03 (Identity and Privilege Abuse), OWASP describes "synthetic identity injection", where attackers impersonate internal agents with unverified descriptors such as "Admin Helper" to inherit trust. Under ASI07 (Insecure Inter-Agent Communication) it describes spoofed agent descriptors and fake peer agents registered in discovery services.
- Agents used to deceive humans: ASI09 (Human-Agent Trust Exploitation) covers agents whose fluency and perceived authority lead people to approve harmful actions, with scenarios such as a prompt-injected IT support agent harvesting a new hire's credentials and a poisoned finance copilot recommending an urgent payment to attacker bank details.
The controls mirror the human ones. Give each agent a verifiable identity, authenticate and sign agent-to-agent messages, scope agent permissions to the task, and require explicit human confirmation, made in an authenticated system, before an agent moves money, changes access or exports data. OWASP also recommends immutable logs of user queries and agent actions. See the Multi-Agent and A2A Security Guide, the AI Agent Authorisation Guide and Human vs Non-Human Identity.
Framework mapping
Control areas mapped to NIST CSF 2.0, NIST SP 800-53 Rev. 5, ISO/IEC 27001:2022 Annex A, CIS Controls v8.1 and the OWASP agentic list.
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | CIS Controls v8.1 | OWASP Agentic 2026 |
|---|---|---|---|---|---|
| Dual approval and separation of duties for payments and access changes | PR.AA-05 | AC-5, AC-3(2) | A.5.3 | No direct safeguard | ASI09 |
| Identity-bound approval and phishing-resistant MFA | PR.AA-03 | IA-2(1), IA-2(2), IA-10 | A.8.5 | 6.3, 6.4, 6.5 | ASI03 |
| Help desk resets and authenticator management | PR.AA-01, PR.AA-02 | IA-5, IA-12 | A.5.16, A.5.17 | 14.9 (role-specific training) | Not applicable |
| Remote identity verification and hiring checks | PR.AA-02, GV.RR-04 | IA-12(2), IA-12(3), PS-3 | A.6.1 | No direct safeguard | Not applicable |
| Awareness and role-based exercises | PR.AT-01, PR.AT-02 | AT-2(1), AT-2(3), AT-3 | A.6.3 | 14.2, 14.9 | Not applicable |
| Reporting suspected impersonation | RS.MA-02 | IR-6, AT-2(4) | A.6.8 | 14.6, 17.3 | Not applicable |
| Email authentication and filtering | No direct subcategory | SI-8 | A.5.14 | 9.5 | Not applicable |
| Monitoring identity changes after calls | DE.CM-03, DE.AE-03 | SI-4, AU-6 | A.8.16 | Control 8 | ASI09 (immutable logs) |
| Agent identity and inter-agent trust | PR.AA-01, PR.AA-03 | IA-9 | A.5.16 | No direct safeguard | ASI03, ASI07 |
Common failure patterns
- Approvals accepted on the call itself: the request and its verification travel over the same channel the attacker controls. At Arup, the fraud surfaced only when the worker contacted head office directly.
- Help desk verification by researchable facts: CISA reports that Scattered Spider first calls to learn the reset steps, then calls again with the target's details; see MGM Resorts Breach 2023.
- Push MFA without number matching or phishing resistance: a caller can talk a user through approving a prompt, as in the Cisco Breach 2022.
- End users allowed to grant powerful app consent: in the ShinyHunters campaign, victims approved a malicious connected app while on the phone with a fake IT support caller.
- No review after authenticator changes: in the Storm-2949 activity Microsoft described, resets were followed by the attacker enrolling its own authenticator.
- Relying on a deepfake detector or a single liveness check: NIST notes detectors generalise poorly to new generators, and that a biometric comparison alone does not stop injection attacks.
Metrics that show progress
| Metric | What it shows | Target direction |
|---|---|---|
| Share of payments above threshold approved by two people in an authenticated system | Whether dual approval is real or bypassed | Up, towards 100% |
| Share of supplier bank detail changes verified by call-back to a pre-existing number | Supplier impersonation exposure | Up, towards 100% |
| Share of help desk resets that used the approved verification method | Help desk resilience to callers | Up |
| Share of privileged and finance users on phishing-resistant MFA | How many key users can be talked through a prompt | Up |
| Simulated impersonation exercise: report rate and time to report | Whether staff verify and escalate under pressure | Report rate up, time down |
| Authenticator changes after resets reviewed within one working day | Detection of reset abuse | Up |
| Agents able to move money or change access without human confirmation | Agent impersonation and manipulation exposure | Down, towards zero |
Implementation roadmap
| Phase | Actions |
|---|---|
| First 30 days | Publish the out-of-band verification rule for payments, bank details and resets; confirm dual approval thresholds; brief finance, help desk and executive assistants; set up a simple reporting route |
| By 90 days | Rewrite help desk verification to remove researchable facts; enforce phishing-resistant MFA for privileged, finance and help desk staff; require admin approval for connected apps and remote tools; alert on resets followed by authenticator changes |
| By 180 days | Move approvals into authenticated workflows; add injection and presentation attack detection to remote verification and hiring; run role-based impersonation exercises; inventory agents that can act on payments or access and add human confirmation |
| Ongoing | Track the metrics above, rerun exercises, review new incidents and advisories, and test any detection tool against new generators |
Practitioner checklist
- Publish a rule that payments, bank detail changes and access resets are verified out of band through known channels.
- Require dual approval and cooling-off periods for high-value payments and payee changes.
- Move approvals into systems with strong authentication instead of phone, video, chat or email.
- Rewrite help desk verification so it does not depend on researchable facts, and retire voice-only caller authentication.
- Enforce phishing-resistant MFA for privileged, finance and help desk staff.
- Alert on password resets followed by authenticator changes, and on MFA approvals or app consents after inbound calls.
- Use presentation attack detection, injection detection and chip reading in remote identity verification.
- Verify identity during hiring, at onboarding and during employment for remote workers.
- Enforce DMARC, flag external senders and label external meeting and chat participants.
- Train finance, help desk, executive support and recruiters on process, with realistic exercises and rewarded reporting.
- Give AI agents verifiable identities and require human confirmation for sensitive agent actions.
Standards and references
- NIST: SP 800-63A-4 Digital Identity Guidelines, Identity Proofing and Enrollment
- NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
- NIST: AI 100-4 Reducing Risks Posed by Synthetic Content
- C2PA: C2PA and Content Credentials Explainer
- CISA and FBI: Advisory AA23-320A Scattered Spider
- FinCEN: Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FIN-2024-Alert004)
- FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
- FBI IC3: Senior US Officials Impersonated in Malicious Messaging Campaign
- FBI IC3: North Korean IT Workers Conducting Data Extortion
- MITRE ATT&CK: Phishing: Spearphishing Voice (T1566.004)
- OWASP: Top 10 for Agentic Applications for 2026
- UK NCSC: Phishing scams, how to spot and report them
Related NHI Mgmt Group resources: Account Recovery and Help Desk Security Guide · Vishing and Smishing Guide · Email Identity and BEC Guide · Fraud and Cyber Convergence Guide · Workforce Identity Security Guide