No. Voice and video can support communication, but they cannot establish identity on their own because spoofing, cloning and pretexting are now cheap and convincing. Organisations should reserve high-trust actions for proof that is harder to counterfeit, such as device binding, verified callbacks and transaction-specific confirmation.
Why voice and video fail as standalone proof
Voice and video are useful for communication, but they are weak identity evidence because they are easy to capture, replay, alter or impersonate. A familiar face on screen or a recognisable voice on a call can create a false sense of trust, especially when the request feels urgent or routine. That makes them suitable for interaction, not for high-trust authentication.
For practitioners, the key distinction is between recognition and verification. Seeing or hearing someone may help you decide who you think you are dealing with, but it does not prove that the person is the legitimate actor, that the channel is uncompromised, or that the request has not been staged by an impersonator.
Modern attackers can exploit that gap with low-cost tooling, including voice cloning, deepfake video, voicemail spoofing and scripted pretexting. The problem is not only technical deception, it is also social conditioning: once a team accepts voice or video as sufficient proof, it becomes easier to authorise actions that should have required stronger evidence. NHIMG’s Ultimate Guide to NHIs is useful here because the same principle applies across identity types, proof must be harder to counterfeit than the channel used to request action.
What organisations should use instead of voice-only trust
High-trust actions should be gated by evidence that is bound to a known device, account, or transaction context. In practice, that means using verified callbacks to a known number or directory entry, device binding, strong re-authentication, and transaction-specific confirmation for sensitive changes such as payment approval, credential reset, bank detail changes or privilege elevation.
Where possible, use a second path that is independent of the original communication channel. A callback, signed approval workflow, or out-of-band confirmation reduces the chance that one compromised conversation can carry the whole decision. The control is stronger when the verification step tests something the attacker is less able to reproduce, such as possession of a managed device or control of an enrolled authenticator.
For remote workflows, the best evidence is usually layered. A live call may help with coordination, but it should be paired with a device-authenticated session, a known contact method, or a cryptographic or workflow-based confirmation. The more consequential the action, the less acceptable it is to rely on human familiarity alone. NIST SP 800-63 Digital Identity Guidelines support this posture by emphasising stronger authenticators and assurance-based verification rather than simple presentation of a voice or image.
Where the control boundary should be drawn
Organisations should treat voice and video as low-assurance communication inputs and reserve them for coordination, not authorisation. That boundary matters most in finance, customer support, executive assistance, IT help desks and any process that can trigger reset, release, transfer or access changes. If the request can change money, identity state, or privileged access, voice and video should never be the only proof.
The practical rule is simple: the higher the potential blast radius, the more the confirmation must be tied to an independent trust anchor. Device binding, verified callbacks and transaction-specific approval all reduce reliance on human recognition, which is exactly where spoofing and pretexting succeed. RFC 9449: OAuth 2.0 Demonstrating Proof of Possession reflects the same logic in token security, binding approval to the holder of a specific proof rather than to something that can be copied or replayed.
In governance terms, the right question is not “did we speak to the right-looking person?” It is “did we verify the request through a method that resists impersonation and remains valid if the call, meeting, or recording is fake?” That mindset is especially important for approvals that may be socially engineered rather than technically breached. The verification path should be designed so that a convincing voice or video can never complete the transaction on its own. Identity Security Programme Guide is a useful companion for structuring those controls across human and non-human identities.
Risk and Threat Considerations
Voice and video are attractive to attackers because they bypass instinctive trust cues while leaving many organisations without a consistent verification process. The main risk is not just impersonation, but downstream authorisation of resets, transfers or access changes based on a channel that can be forged at scale.
Failure mechanism: An attacker uses cloned audio, synthetic video, or a rehearsed pretext to create confidence in a request, then relies on weak internal procedures to push a sensitive action through without independent verification.
Impact: The result can be credential reset, payment diversion, privileged access change, fraud, or broader account compromise, especially when staff assume that seeing or hearing someone is enough proof.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Guides assurance-based identity verification beyond voice or video. |
| Recommendation — Use higher-assurance authenticators and verification methods for sensitive actions. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Covers strong user authentication for actions needing trusted identity proof. |
| IA-5 — Authenticator Management | Covers lifecycle and protection of credentials used for reliable proof. | |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Applies when external parties must be verified before trust decisions. | |
| Recommendation — Require strong authentication before allowing privileged or sensitive actions. Manage authenticators so proof depends on protected, revocable credentials. Authenticate external users through stronger proof than voice or video. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Shows why weak proof methods let attackers impersonate legitimate actors. |
| API5 — Broken Function Level Authorization | Relevant when voice or video is used to authorise sensitive actions. | |
| Recommendation — Use strong authentication controls instead of easily spoofed proof signals. Require explicit authorisation checks before executing high-impact functions. | ||
| CIS Controls v8 | CIS-5 — Account Management | Addresses controlled account changes, resets and access approvals. |
| Recommendation — Tighten approval paths for resets, transfers and privilege changes. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Supports rules for who may approve or receive high-trust access changes. |
| A.5.16 — Identity management | Applies to verifying and managing identity proof for sensitive processes. | |
| A.5.17 — Authentication information | Covers stronger proof material than audio or video presence. | |
| Recommendation — Define and enforce access approval rules that do not rely on voice alone. Use managed identity proofing processes for trust decisions. Protect and use authentication material that cannot be easily impersonated. | ||
Practitioner Guidance
What to prioritise: Protect the few workflows that can create the greatest harm first, such as password resets, payment changes, access elevation, and exceptions handled by help desks or assistants. Those are the places where a convincing voice or video most often becomes an enabling condition for fraud or compromise.
What to verify: Require a second verification path that is independent of the original voice or video session, and make sure it is tied to a known device, enrolled authenticator, or transaction-specific approval. If the same channel is used to ask and answer the question, the control is usually too weak.
Common mistake: Treating a live conversation as if it were proof of identity. The conversation can support context, but the decision should rest on a harder-to-fake factor, especially where the action is irreversible or high impact.
Practitioner takeaway: Voice and video should lower friction, not raise trust, and any process that can materially change identity state, money movement, or privilege should require independent verification before it is allowed to proceed.
Related resources from NHI Mgmt Group
- What breaks when organisations trust caller ID or voice as proof of identity?
- What breaks when organisations treat device biometrics as proof of identity for remote access?
- What breaks when organisations treat a password or SSN as sufficient proof of identity?
- What happens when organisations try to verify identity with video or voice alone in a high-stakes process?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org