Voice
Voice cloning scams: when the caller sounds right
A cloned voice is the cheapest deepfake to use against an organisation: it needs only a phone line. The defence is a call-back rule, not a better ear.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
The scam
What a cloned voice call looks like
Report Fraud, the UK police fraud reporting service, says fraudsters generate fake audio clips imitating the voice of someone you know or trust, often claiming an urgent situation and asking for a payment [9]. The same page advises hanging up and contacting the real person or organisation through details you know are correct [9].
In a business setting the "someone you trust" is usually a director, a finance lead or a supplier contact. The request tends to be small in form, such as a bank detail to change or a payment to release, and large in effect.
How common
What the evidence shows
Gartner's survey of security leaders, reported by The Register, found 44% had experienced at least one deepfake audio call against staff in the past year [7]. Of those, 6% caused business interruption, financial loss or lost intellectual property, and the loss rate fell to 2% where an audio screening service was used [7]. The article does not state the number of respondents, so the percentages are indicative only [7].
Sophos's Chester Wisniewski told The Register that audio calls can now be generated in real time, while real-time video fakes of a specific individual remain incredibly expensive [7].
Defences
Cards to put in front of staff
Call back on known details
Ring back on a number you already hold, never on one given during the call, and do not trust caller ID [9].
Agree a second route
For payments, use a second type of communication such as a message to a known account or a logged-in system [8].
Slow down on urgency
Report Fraud notes that these calls claim an urgent situation [9]. Make urgency a trigger for the check, not an excuse to skip it.
Limit what one call can do
No single call, however senior it seems, should be enough to change bank details or release a transfer. See payment approval checks.
Why not rely on detection
The limit of screening
Audio screening reduced losses in the Gartner figures [7], but a screening service is a purchase, not a policy. Use it as an extra layer, behind the call-back rule and not in place of it.
Related: how to spot a deepfake call.
Keep reading
Read next
Payment checks
How to design payment and bank detail checks so a cloned voice or fake video call cannot release money: who approves, what is confirmed and how.
Read the guide
Spotting a fake
What to do when a call or video meeting seems off: the pressure signs that matter, why visual glitches are unreliable and what to ask instead.
Read the guide
If money has gone
Practical steps for a UK organisation that has paid a criminal after a fake call or video meeting: bank, police, records, staff and review.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.