Deepfake Attack

Description

This is not merely a technical curiosity. Deepfakes strengthen classic social engineering because they give the attacker what used to be largely out of reach: a convincing voice, face and manner of a known person. Combined with good context, the victim is no longer checking only the message but their own impression that they can see and hear the real person.

The greatest risk is not that everyone will believe every recording, but that organizations will carry on using voice and video as proof of identity. In a world where a voice can be copied, confirmation has to go through a procedure, an independent channel and rules agreed in advance.

Examples

• An employee receives a call with a voice resembling the director's and a request to approve a payment urgently.
• A fake participant resembling a manager appears in a video meeting and gives instructions to the finance team.
• An audio message from a supposed colleague asks for an MFA code or a change of access, on the pretext of an urgent problem.

Notes

• A voice is no longer proof of identity. Video is not enough either, if the request bypasses the procedure.
• Sensitive actions need confirmation through another channel, not a better feeling that the person on the line really is who they say.