Deepfake Readiness: 16 Best Practices to Stop a Cloned Voice From Moving Money or Access

By Manny Fernandez

October 14, 2026

Deepfake Readiness: 16 Best Practices to Stop a Cloned Voice From Moving Money or Access

The Tuesday Afternoon Call

It is a quiet Tuesday afternoon. The HR director’s video flickers to life on Zoom, or a recording that looks and sounds flawlessly like her. Her connection is lagging, she is currently visiting an overseas branch, and an urgent background check system migration needs a temporary IT bypass code generated before close-of-business. Moments later, a direct message arrives with the specific account credentials to “speed things up.”

That scenario used to be a conference demo. It is now an incident category. In a 2025 Gartner survey of 302 cybersecurity leaders, 62% reported at least one deepfake attack against their organization in the previous 12 months, with 43% reporting a deepfake audio call and 37% running into deepfakes on video calls. A January 2026 Osterman Research study (commissioned by IRONSCALES) found that 60% of 128 US security and IT leaders were not confident they could counter deepfake attacks, even with the training they already run.

And a bypassed security control is only the obvious target. The same cloned video can call your help desk to migrate an MFA token to a “new device,” or ask an identity admin to provision a privileged account for an “emergency audit.” A fraudulent wire usually surfaces at reconciliation. A quietly added global admin can sit there for months.

Bottom line: Detection by ear is a losing game. The FBI has already warned that cloned voices can sound nearly identical to the real person. The control that holds up is a verification step that runs every single time money, credentials, or permissions are involved, no matter how convincing the caller sounds.

Below are 16 best practices, grouped into five areas: map the exposure, write the rules, build the culture, drill it, and layer the tech. Use them as a checklist.

Part 1: Map the Exposure

01Inventory the identities worth cloning

Why it matters: Attackers impersonate whoever can approve money or direct staff. The C-suite is obvious, but the director layer is the sweet spot: a VP of Finance calling AP is routine, a surprise call from the CEO raises eyebrows.

How to do it:

List the CEO, CFO, CIO, CISO, and general counsel.
Go one level down: VPs and directors in finance, IT, and HR who make these requests weekly.
Add external authorities: a key supplier’s AR contact, your MSP’s lead engineer, your bank relationship manager.

02Inventory the people who will get the call

Why it matters: The targets are the people who can execute. The help desk and identity admins are the most frequently forgotten, and they are the fastest path to account takeover.

How to do it:

Accounts payable, treasury, payroll, HR, and executive assistants.
IT help desk staff who can reset passwords or re-enroll MFA.
Anyone who can create accounts or change group membership in your identity platform (Entra ID, Okta, AD, FortiAuthenticator, and so on).

03Score each executive’s public audio and video exposure

Why it matters: Earnings calls, podcasts, keynotes, webinars, and social clips are free training data. A few minutes of clean audio from one webinar can be enough, so do not assume only the camera-heavy CEO is at risk.

How to do it:

Note the hours of public recordings per person on the Practice 1 list.
Treat anyone with any recorded talk as cloneable, which pulls most directors in.
Combine Practices 1 to 3 into a simple matrix: who gets faked, who gets called. In most orgs this is a few dozen people. Very manageable.

Part 2: Write the Verification Rules

04Mandate an out-of-band callback from a trusted source

Why it matters: This is the single most important control. A drill without a written rule only measures instinct.

How to do it:

Any request to move money, change bank details, share credentials, reset MFA, or change access gets confirmed by calling back.
The callback number comes from the internal directory or the vendor master file. Never from the email, voicemail, chat, or caller ID of the request itself.
Make sure the directory is actually current. Drills routinely reveal that nobody knows which number to call.

05Define hard thresholds that always trigger verification

Why it matters: “Verify unusual requests” is a judgment call, and judgment collapses under pressure from a senior voice. Thresholds remove the judgment.

How to do it:

Write down the specific actions that always require verification regardless of who is asking or how urgent it sounds.
Examples: any new payee, any bank detail change, any payment over a set amount, any MFA reset, any privileged group change.

06Require dual approval on the high-risk changes

Why it matters: One fooled employee should never be enough. A second approver breaks the single point of failure that deepfake fraud depends on.

How to do it:

Two people sign off on new payees and changed banking details.
Two people sign off on new privileged accounts and role changes.
Enforce it in the system (ERP workflow, PAM, identity governance) rather than only in policy.

07Issue rotating challenge phrases for the most-impersonated executives

Why it matters: A voice can be cloned. A shared secret that rotates on a schedule cannot be scraped from a keynote.

How to do it:

Limit it to the top executives and their direct support staff (EAs, finance leads).
Rotate on a fixed schedule and distribute through a channel that is not email or chat.

Verification Rule Template (paste into your policy)

HIGH-RISK REQUEST VERIFICATION STANDARD

Scope (always verify, no exceptions):
  - New payee or change to existing banking details
  - Any payment at or above $[THRESHOLD]
  - Password reset, MFA reset, or MFA device re-enrollment
  - New account, privileged group add, or role change
  - Any request to share credentials, tokens, or codes

Required steps:
  1. Pause. Do not act on the original channel.
  2. Call back using ONLY the internal directory or vendor master file.
  3. For [EXEC LIST], request the current challenge phrase.
  4. Obtain second approver sign-off for payee, bank, or privilege changes.
  5. If anything feels off, report to [SOC CHANNEL / PHONE] immediately.

Permission to pause:
  Hanging up and calling back is ALWAYS approved by [CEO] and [CFO].
  No employee will be penalized for delaying a request to verify it.

No-blame reporting:
  If you already acted on a suspicious request, report it now.
  Speed of reporting matters more than the mistake.

Part 3: Build the Culture That Lets the Rules Work

08Give everyone written permission to pause

Why it matters: Deepfake fraud runs on urgency and hierarchy. An employee who thinks slowing down a VP will hurt their review is the easiest target in the building.

How to do it:

Have the CEO and CFO state in writing that nobody gets in trouble for hanging up and calling back.
Repeat it at all-hands and in onboarding. Once is not enough.
Encourage people to trust their gut: the voice can be perfect and the request can still feel wrong.

09Make reporting no-blame and fast

Why it matters: If the first person who admits they paid a fake invoice gets shamed, the next person stays quiet while the attacker keeps working.

How to do it:

Anyone who realizes they already paid, reset, or granted something reports it immediately.
Measure and reward speed of reporting, not just avoidance of mistakes.
Publish a single, obvious reporting path to the SOC.

10Treat channel switching and “technical problems” as a red flag

Why it matters: FinCEN’s deepfake fraud alert specifically calls out people who switch communication methods mid-conversation and blame glitches. That “bad connection” is often the tell.

How to do it:

Train staff that a request jumping from email to voice to Teams is a reason to slow down, not speed up.
A caller who cannot stay on video, or whose audio keeps “dropping,” triggers the callback rule automatically.

11Watch for the malicious request buried in a legitimate one

Why it matters: The most dangerous access attack looks like hygiene. Strip rights from five users, and while you are in there, add one contractor to a privileged group “for the auditors.” Most of the batch is right, so the whole batch gets approved.

How to do it:

Require that every privilege grant is verified on its own, even inside a cleanup or bulk change.
Have identity admins approve additions separately from removals.

Part 4: Drill It Before an Attacker Does

12Build multi-channel scenarios, with consent

Why it matters: Real attacks rarely arrive as one phone call. They set up context in email or chat, then apply pressure by voice or video. Your drills should follow the same path.

How to do it:

Get sign-off from legal, HR, and every executive whose identity will be used before you clone anything.
Use a consenting executive’s voice, a clearly labeled synthetic stand-in, or a live actor working from a script.
Time scenarios to real pressure points: quarter close, audit season, pre-holiday, and weeks when executives are publicly traveling.

Four starter scenarios that cover most of the risk

Scenario	Setup channel	Pressure channel	What it tests
Urgent CFO wire	Spoofed email about a confidential acquisition payment	Voicemail in the CFO’s voice to the controller	Callback, payment threshold, dual approval
Supplier bank change	Message from a known vendor contact with new banking details	Teams call from the “vendor” to confirm	Vendor master callback, bank change dual approval
Help desk MFA reset	None, or a quick chat ping	Call from the “VP of Sales,” traveling and locked out before a board meeting	Help desk identity verification, MFA re-enrollment rules
Access cleanup	Email from the CISO’s office announcing a permissions review	Teams call from the “IT director” walking an admin through it, including one privileged add	Bundled request scrutiny, privileged change approval

13Run it in stages, with guardrails

Why it matters: A tabletop finds policy gaps cheaply. A live simulation tells you what people actually do. Guardrails keep the live round from turning into a real incident or a trust problem.

How to do it:

Start with a tabletop: walk the target group through each scenario and ask what they would do at each step.
Brief a small control group (executive sponsor, SOC lead, head of finance) so a real escalation does not kick off real IR.
Keep money and access out of reach: a test payee, payments that stop at approval, a sandbox group with no real privileges.
Set stop conditions. If someone gets distressed or the scenario bleeds into real business, end it and debrief on the spot.
Tell every participant afterward, every time. A drill that feels like a trap burns the trust the program depends on.

14Measure behaviors, not a pass/fail score

Why it matters: A single score is the least useful number a drill produces. The behaviors underneath tell you exactly what to fix.

How to do it:

Use the scorecard below, and spend the most time on break points: each one maps to a specific fix in policy, tooling, or training.

Drill scorecard

Metric	What to capture	Why it matters
Verification rate	Share of participants who used the documented callback or challenge step before acting	Shows whether the rule exists in practice, not just on paper
Time to escalation	Minutes from first contact to a report reaching security	Fast reports limit damage even when someone is fooled
Report path	Did the report reach the SOC through the expected channel, or stall in a manager’s inbox?	Exposes broken or unclear reporting routes
Break points	The exact step where the process failed (no directory number, unclear threshold, “exec” pushed to skip callback)	Each break point is a concrete remediation item
Bundled requests	Did anyone question the privileged add hidden in the cleanup?	Tests Practice 11 directly
Trust signals cited	What participants say convinced them (“sounded exactly like him” vs. “the email came first”)	Different answers point to different fixes

15Debrief the same day, fix, and repeat

Why it matters: People who fall for a well-built drill feel lousy. A fast, blameless debrief turns that into learning instead of resentment.

How to do it:

Debrief same day. Tell people the scenario was built to fool them, because it was.
Show what was fake, how it was built, and which signals they could have checked.
Fix what broke: update the callback directory, tighten thresholds, fold the scenarios into your regular phishing simulation program.
Repeat at least twice a year, and any time the exposure list changes (new CFO, acquisition, heavy conference season).
Rotate scenarios so nobody passes by recognizing the script.

Part 5: Layer the Technology

16Add tooling at the two points where it actually helps

Why it matters: Process carries most of the load. Technology helps at two specific points in the attack chain, and it should be evaluated with privacy in mind.

How to do it:

The setup message. Most voice and video deepfakes are preceded by an email or chat that sets context. Behavioral email security that flags unusual requests from executives, managers, or vendor contacts can break the chain before the call ever happens. If you run FortiMail, review your impersonation and BEC protections against your Practice 1 list.
The live call. Real-time identity verification for collaboration platforms like Microsoft Teams compares voice and video against the real speaker. Prefer approaches that verify the person (behavioral and biometric profiles) over pure artifact detection, which gets weaker with every new generation model.
Privacy check. Ask every vendor whether the tool records or transcribes meetings, or only processes signals in the moment.
Harden the help desk. Pair the callback rule with strong identity proofing before any MFA re-enrollment, so a convincing voice alone can never move a token.

Quick-Start: Your First Drill This Quarter

A first drill does not need a budget line. It needs this:

Two lists: who gets impersonated and who gets called (Practices 1 to 3).
One page of verification rules: use the template above (Practices 4 to 9).
Four scenarios: the starter set in Practice 12.
One scorecard and a debrief template: Practices 14 and 15.

The InfoSecMonkey take: Don’t just do something, stand there. One minute of pause and one callback to a number you already trust costs nothing. Acting on the fake can cost the company a wire, an admin account, or both.

Deepfake Readiness: 16 Best Practices to Stop a Cloned Voice From Moving Money or Access

The Tuesday Afternoon Call

Part 1: Map the Exposure

01Inventory the identities worth cloning

02Inventory the people who will get the call

03Score each executive’s public audio and video exposure

Part 2: Write the Verification Rules

04Mandate an out-of-band callback from a trusted source

05Define hard thresholds that always trigger verification

06Require dual approval on the high-risk changes

07Issue rotating challenge phrases for the most-impersonated executives

Part 3: Build the Culture That Lets the Rules Work

08Give everyone written permission to pause

09Make reporting no-blame and fast

10Treat channel switching and “technical problems” as a red flag

11Watch for the malicious request buried in a legitimate one

Part 4: Drill It Before an Attacker Does

12Build multi-channel scenarios, with consent

13Run it in stages, with guardrails

14Measure behaviors, not a pass/fail score

15Debrief the same day, fix, and repeat

Part 5: Layer the Technology

16Add tooling at the two points where it actually helps

Quick-Start: Your First Drill This Quarter

Recent posts