Combining technical controls, approval workflows and tested procedures can stop impersonation scams exploiting authority, urgency and familiarity.

The underlying weakness in the company was the same as in other cases: a trusted identity, placed in a credible context, gave authority to a fraudulent request.

Separating identity recognition against process request

AI-generated voice and video now allow attackers to reproduce more of the signals people traditionally use to decide whether someone is genuine. No matter how confidently a person is convinced of another person’s identity, it is still a poor substitute for thorough identity verification.

Studies on deepfake perception have found a considerable gap between people’s belief that they can recognise manipulated content, and their ability to do so reliably, especially when synthetic media becomes more convincing. Using familiar defects in a face, voice or video as warning signs will become less dependable. Awareness training still matters, but its purpose should be to help employees recognise when to pause and invoke a verification process, not turn them into deepfake analysts.

The more dependable approach is to verify the requested action, not just the person apparently making it. An employee should not have to prove that a video or voice is false before declining a consequential request. A routine conversation may not require additional checks — but a request to transfer money, disclose sensitive information, change payment details or grant access — should. The greater the potential consequence, the stronger the confirmation required.

That confirmation must be independent of the original interaction.

• Calling a known number from the corporate phone directory is stronger than using contact details supplied in the message.
• Confirming a payment through an established internal system is stronger than replying to the same email thread.
• Requiring a second authorised person to approve a significant transaction creates another opportunity to stop an attack. (with caveats)

The key word is independent. Moving from email to a video call does not provide meaningful confirmation if the attacker controls both. Neither does asking the supposed executive on the call whether the request is genuine.

When strict verification is an expectation

Verification procedures must also survive urgency and hierarchy. Attackers often create pressure precisely because people are more likely to bypass normal checks when they believe a senior leader is waiting. Employees may hesitate to question an executive or delay a request presented as confidential.

Corporations therefore need to make verification an expected part of the process rather than an act of suspicion or insubordination. A senior executive should not be able to waive a safeguard through the same channel being used to make the request. If urgency can override a control, attackers will manufacture urgency.

These safeguards must work across the ways employees now communicate. A suspicious request may begin by email, continue through a messaging platform and conclude on a video call. Testing each channel separately can miss how attackers combine them to build credibility.

Organisations should therefore test complete scenarios:

• Could an attacker use a compromised email account to arrange a call?
• Would appearing on video be treated as sufficient confirmation?
• Could one employee authorise the request alone?
• Would the organisation recognise unusual behaviour across those interactions?

Technical controls still matter, and the relevant signals often sit apart. One system may see a suspicious message; another an unusual login; and another notice unexpected access to sensitive data. Examined separately, each event may appear inconclusive. Considered together around the person, request and action, they can reveal that an employee is being heavily targeted or that an account is behaving outside its normal pattern. That distinction should shape the response.

An employee with a strong security record may still face concentrated attacks because their role gives them authority over payments, systems or sensitive information. The answer is not automatically more training. It may be: stronger authentication, tighter approval requirements, closer monitoring, or an automatic pause on the requested action.

Trust cannot undo an irreversible act

Technology alone cannot replace sound business processes. Deepfake detection capabilities will continue to improve, but no single system will identify every convincing fabrication. Durable defenses combine technical controls with approval workflows that do not depend on proving whether every face, voice or message is authentic.

The goal is not to make employees distrust every digital interaction. It is to ensure that trust alone cannot authorise an irreversible action. A face can be copied. A voice can be cloned. A writing style can be imitated. What is much harder to reproduce is a well-designed process that requires independent proof before an organisation acts.

In a nutshell: Do not let a convincing presentation alone authorise high‑risk actions; require independent verification, multi‑party approval, risk‑based thresholds, and documented, tested procedures to be satisfied first.