The phone call is now part of the attack surface
A recent SC World explainer describes how attackers can use publicly available audio to generate convincing voice impersonations of executives. That changes the question for compliance and risk teams.
The issue is not simply whether an employee can hear that a caller sounds unusual. A caller may sound familiar, know the organisation’s terminology, and create a credible reason for urgency. The real control is what happens next: does the employee independently verify the request, follow the approved callback route, require a second approver, and record the decision before money, access or sensitive information moves?
This is why voice fraud belongs in operational resilience testing, not only in awareness training. A second vishing explainer from Boxphish identifies common targets including passwords, passcodes and trusted-person impersonation. Those are workflow events. They should be tested as workflows.
Recognition is not the same as resistance
A staff member might correctly identify suspicious wording in a training email and still approve a beneficiary change during a convincing call from a supposed director. Under pressure, hierarchy, urgency and helpfulness can override a general instruction to “be vigilant”.
The relevant test questions are more concrete:
- Does the employee challenge an urgent payment instruction from a senior executive?
- Do they use a known contact method rather than the number supplied by the caller?
- Do they refuse to disclose a one-time passcode or reset credential?
- Do they escalate when the caller resists the firm’s verification process?
- Does the system require a second person to approve a high-risk change?
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that synthetic audio and video can be generated in response to live prompts. It endorses live verification while making clear that verification alone may not be sufficient. The implication for regulated firms is practical: controls need to be designed around independent, deepfake-resistant verification and tested against realistic social pressure.
DORA Article 26, live since 17 January 2025, requires threat-led penetration testing that explicitly considers people, processes and technologies, with ethical boundaries for social engineering. In the UK, the Payment Systems Regulator’s APP reimbursement regime has applied since 7 October 2024, with reimbursement of up to £85,000 per Faster Payments scam claim. A failed call-handling workflow can therefore become both a resilience issue and a quantified financial exposure.
What the Vishing Readiness Assessment delivers
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting 2 to 3 weeks. An AI red-team places controlled vishing calls against agreed staff and workflows, such as payment approval, beneficiary change, password reset and VIP servicing.
We do not reduce the result to a detection score. We document who was contacted, what the caller asked for, which controls were used, where the workflow broke, and what remediation is required. The result is a sealed, board-ready evidence pack for the board, insurer, auditor or regulator.
Entry pricing is around £9,500. Book an assessment to test whether your people and phone workflows would withstand an AI voice-fraud attempt.