Vishing and voice deepfakes: how AI-powered phone fraud works and how to stop it

By Kike Gandia · Co-Founder & CEO, OSCP

Vishing is phishing by phone: the attacker calls posing as IT support, the bank, a supplier or an executive to obtain credentials, a payment, or a password or MFA reset from the help desk. AI has made it more convincing: a few seconds of public audio are enough to clone a voice, and in 2024 an Arup employee transferred about $25 million after a video call with deepfakes of the company's CFO. This guide explains how it works, why the help desk is the most profitable target, which warning signs to watch for and which controls stop it without relying on anyone noticing the voice is fake.

What vishing is and why it still works

Vishing (voice phishing) is social engineering over the phone: the attacker calls, presents themselves as someone trustworthy and asks for something that should never be obtainable with a single call. The scripts used against companies are few and keep repeating:

• Fake IT support: “We're calling from Microsoft” or “from IT, we've detected a problem on your computer”. The goal is for the victim to install a remote access tool, read out a verification code or type their password into a site the caller points to.
• Fake bank: a supposed fraud alert on the company account that, to “block” it, requires confirming credentials, reading out transaction signing codes or moving the money to a “safe” account.
• Fake supplier or executive: a call that accompanies or replaces the email asking to change bank details or make an urgent payment, which is CEO fraud territory.
• Help desk call: the attacker poses as an employee who has lost their phone or is locked out and asks for a password or MFA reset. It is the most dangerous vector and has its own section below.

It works for three reasons. A voice builds more trust than an email and leaves less time to think. Caller ID can be spoofed, so seeing the bank's or head office's real number on screen proves nothing. And the call goes through no filter: there is no email gateway to flag it and no link to scan. It is often combined with other channels, such as an email asking you to call a “support” number (callback phishing) or a text message that sets up the call.

What AI changes: cloned voices, fake video calls and calls at scale

The scripts are the same as ever. What has changed is how little it costs to make them believable:

• Voice cloning from very little audio. In 2023 Microsoft presented VALL-E, a research model that imitates a voice from a 3-second recording, and in 2024 OpenAI showed Voice Engine, which works from a 15-second sample and was only opened to a small group of partners because of the risk of misuse. Commercial voice cloning tools are now available to anyone, and an executive with published interviews, talks or corporate videos has left more than enough material.
• Deepfakes on video calls. “I saw him in the Teams meeting” is no longer proof. A call can be staged with several synthetic faces and voices, or with real YouTube footage reused, as in the Arup and WPP cases described below.
• Scale and automation. Generative AI cuts the work needed to prepare each scam: scripts tailored to the victim with LinkedIn data, fluent language without the accent that used to give attackers away, and voice agents able to hold a conversation and place many calls at once.

The last row is the one that matters. The controls that work against AI-powered vishing are the same ones that already worked against the classic kind. What stops working is the instinct of “I know that voice”.

Real voice and video deepfake cases: what happened and what stopped them

These are publicly documented cases, told only as far as the sources confirm:

• Arup (Hong Kong, 2024). An employee at the British engineering firm's Hong Kong office received a message from the supposed CFO asking for a confidential transaction. He was suspicious, but was convinced after a video call in which the CFO and other colleagues were deepfakes. He made 15 transfers totalling HK$200 million, about US$25.6 million. Arup confirmed that fake voices and images were used and that none of its internal systems were compromised.
• UK energy company (2019). The head of the UK subsidiary of a German energy group transferred about €220,000 to a supposed Hungarian supplier after a call in which he recognised his boss's slight German accent and the melody of his voice. The insurer Euler Hermes described the case, one of the first known frauds using an AI-generated voice.
• WPP (2024). The attackers created a WhatsApp account with a public photo of chief executive Mark Read and set up a Teams meeting in which they used a voice clone and YouTube footage of a senior executive, while the fake Read typed in the chat. They asked an agency leader to set up a new business in order to extract money and personal details. They did not succeed.
• Ferrari (July 2024). An executive received WhatsApp messages and then a call with a convincing imitation of chief executive Benedetto Vigna's accent about a confidential deal. He noticed something was off and asked for the title of the book Vigna had recommended to him days earlier. The call ended abruptly.
• MGM Resorts and Caesars (September 2023). The attacks on both casino groups attributed to Scattered Spider are associated with social engineering of IT support. Caesars told the SEC the origin was a social engineering attack on an outsourced IT support vendor. At MGM the help desk call was described by the attackers and the press, but the company did not say how they got in; it did estimate to the SEC an impact of about $100 million on its adjusted property EBITDAR.

Why the help desk is the most profitable target

A fraudulent transfer gives the attacker money once. A password and MFA reset gives them a complete corporate identity: email, VPN, single sign-on and, from there, every federated application. That is why groups like Scattered Spider have made the help desk call one of their entry techniques. The joint CISA and FBI advisory on the group describes how they first call to learn what steps the help desk requires for a reset, and then call posing as employees to get passwords reset or MFA tokens transferred.

The help desk is vulnerable by design, not by carelessness:

• Its job is to help, quickly, someone who says they are locked out. Refusing a legitimate request has a visible cost; accepting a fake one does not, until it is too late.
• The data used for verification is usually easy to get: full name, job title, manager's name, employee number, national ID or start date. LinkedIn, old data leaks and an earlier call to another department are often enough.
• A reset cancels out MFA. If one call is enough to register a new device, the second factor stops protecting anything.
• Many help desks are outsourced, with procedures the company does not oversee day to day. Caesars attributed its incident to an outsourced IT support vendor, and in 2025 Clorox sued Cognizant, its help desk provider, alleging it handed passwords to the attackers without verifying their identity. Cognizant rejects those claims.

The practical conclusion: your credential reset procedure is part of your perimeter. It needs to be designed, documented and tested with the same rigour as a firewall.

Warning signs on a call (and their limits)

The signs that remain useful are about what is being asked for, not how it sounds:

• Urgency and secrecy: “it has to go out today”, “don't mention it, it's a confidential deal”.
• New or unusual channel: a different number “because it's a sensitive matter”, a personal WhatsApp, a meeting set up from an account that is not the usual one.
• Bypassing the process: paying a new account, resetting MFA without a ticket, installing a remote access tool “just this once”.
• Hierarchical or emotional pressure: the impatient executive, the key client about to be lost, the auditor who is waiting.
• Requests for codes: no legitimate caller needs you to read out an MFA code or a transaction signing code.
• Resistance to verification: the caller who makes excuses when you say you will call back or confirm through another channel.

What is missing from the list are audio cues: odd pauses, a metallic voice, flat intonation. Sometimes they give the attacker away, as in the Ferrari case, but defences should not be built on them. The next section explains why.

Why you should not trust your ears to spot a deepfake

In a University College London study published in PLOS ONE in 2023, 529 people listened to real and synthetic audio in English and Mandarin. They identified the deepfakes 73% of the time, and being shown examples beforehand only improved results slightly. The authors note they used relatively old synthesis algorithms and conclude that trying to improve human detection is unrealistic.

On a real call conditions are worse than in a lab: poor signal, background noise, time pressure and a person who is not expecting to be deceived. On a video call, poor image quality explains itself with “sorry, my connection is bad”.

That has three consequences for how controls are designed:

• Training should not promise that people will learn to “hear” the fake voice. It should teach them to verify whenever a request fits a risk pattern, however it sounds.
• Automated detection tools can be one more layer, for example in a contact centre, but they should not be the one deciding whether a payment is made or an account is reset.
• Recognising a voice or a face is no longer proof of identity, neither for the employee taking the call nor for systems: some banks' voice authentication has already been beaten with cloned voices.

Process controls: what actually stops vishing

Effective controls share one idea: identity is never proven on the same call in which something is requested.

• Verification through a separate channel the company initiates. For any sensitive request, hang up and call the number in the corporate directory or the supplier master file, never the one the caller gives or the one on screen. If the request came by video call, verification is a separate phone call; if it came by phone, a message on the corporate chat.
• No transfer or reset on the strength of a single call. No payment, bank detail change, privileged access grant or MFA reset is executed based only on what was said in a call or a meeting, however senior the person asking. Management stating this explicitly is what allows an employee to say no to “their boss” without fear.
• Code word or verification question. For leadership and finance, a word agreed in person or a question about something that is not on the internet, as the Ferrari executive did. It should be changed from time to time, never stored in email or chat, and never replace verification through another channel: it is a complement.
• Dual payment approval. The second person approves in the system, not over the phone. How to design payment processes is covered in the CEO fraud guide.
• A help desk identity verification procedure, in writing, the same for everyone and with no exceptions for urgency or seniority. An indicative baseline:

And one rule for the help desk itself: if the caller pushes, gets angry or invokes an executive to skip the procedure, that is a reason to escalate, not to give in.

Technical controls that limit the impact

Processes fail sometimes. Technical controls make sure a failure does not end in a full breach:

• Phishing-resistant MFA: FIDO2 security keys or device-bound passkeys. There is no code a deceived employee can read out over the phone, and the CISA advisory on Scattered Spider recommends it because it resists phishing, push bombing and SIM swapping.
• The help desk cannot reset anyone's MFA: limit who can change authentication methods, require approval from a second role for privileged accounts, and use short-lived one-time temporary access passes instead of disabling MFA.
• Alerts on identity changes: a new MFA method followed by a sign-in from a new location or device is one of the clearest signs of account takeover. The alert has to reach someone who reviews it the same day.
• Control of remote access tools: if only company-approved tools run, the fake technician cannot ask you to install theirs.
• Do not use voice as an authentication factor, neither in internal systems nor with suppliers. OpenAI itself, when presenting Voice Engine, recommended phasing out voice-based authentication for access to bank accounts.
• Less useful information for the attacker: org charts, extensions and internal support procedures should not be public or given over the phone to anyone unverified.

In Microsoft 365 and Entra ID environments, much of this is configured through authentication methods, conditional access and delegated admin roles, and is worth reviewing in a dedicated audit.

How to test it: controlled vishing simulations

The only way to know whether the procedure holds is to call. A well-designed vishing simulation has these pieces:

• Written authorisation and scope: who commissions the exercise, which departments and numbers are in scope, what is out (for example, requesting real payments or unnecessary personal data) and who can stop it at any time.
• Scripts based on real scenarios: fake IT support calling employees, a fake employee calling the help desk for a reset, a fake executive calling finance. Each script sets how far it goes and what counts as a failure.
• The help desk in scope, including an outsourced one, with the provider's agreement. It is where a failure has the most impact and where testing is least common.
• Cloned voices only with consent. If the exercise includes a voice deepfake of an executive, that executive must expressly authorise it.
• Process metrics: how many calls ended in an improper action, how many people verified through another channel, how many reported it and how quickly.
• No individual blame. Results are used to fix procedures and training, not to single out employees, an approach that also makes it easier to fit the exercise within data protection and employment law.

The useful deliverable is not a percentage of people who “fell for it”, but the list of points in the process where a single call was enough to obtain something it should not have, each with its fix.

FAQ

What is vishing?

It is phishing by phone: the attacker calls posing as IT support, a bank, a supplier or an executive to obtain credentials, a payment or remote access to a computer. In a company, the most dangerous variant is the call to the help desk to get an employee's password or MFA reset.

How much audio is needed to clone a voice?

Very little. Research models such as VALL-E (Microsoft, 2023) work from a 3-second recording and Voice Engine (OpenAI, 2024) from 15 seconds. An executive with published interviews, talks or videos has already left enough material, so defences cannot depend on their voice being hard to obtain.

Can you detect a voice deepfake by ear?

Not reliably. In a UCL study published in 2023, participants identified synthetic audio 73% of the time and prior training barely improved results. Defences have to be based on verifying the request through another channel, not on recognising the voice.

Does MFA protect against vishing?

It depends on the type. SMS or app codes can be requested from the victim over the phone, and a deceived help desk can register a new device for the attacker. FIDO2 keys and passkeys hold up much better because there is nothing to read out, as long as the procedure to reset them is just as strict.

What is the difference between vishing and CEO fraud?

CEO fraud is a goal: obtaining a payment by impersonating an executive or a supplier. Vishing is a channel: the phone. They overlap when CEO fraud is carried out by phone or video call with a cloned voice; payment process controls are covered in the dedicated CEO fraud guide.

Is a code word with leadership worth it?

Yes, as a complement. It works if it is agreed in person, never stored in email or chat, changed from time to time and impossible to deduce from anything published. It does not replace hanging up and calling back through a known channel.

Is it legal to run vishing simulations on employees?

It can be if it is set up properly: management authorisation, a defined scope, scripts that do not request unnecessary personal data and results used to improve processes, not to discipline. If an executive's voice is cloned, their express consent is required. How it fits with the GDPR and employment law is explained in our dedicated guide on the legality of simulations.

Related service

social engineering and vishing simulations for businesses

Related content

• CEO fraud: how to lock down payment processes
• What social engineering is and which techniques it uses
• Are phishing and vishing simulations on employees legal?
• Security awareness training for employees
• Microsoft 365 audit: MFA, conditional access and roles
• How Scattered Spider attacked UK retail

Sources

• FBI IC3 — PSA I-120324-PSA: Criminals use generative AI, including voice cloning, to facilitate financial fraud
• CISA and FBI — Advisory AA23-320A on Scattered Spider: help desk social engineering and phishing-resistant MFA
• Mai et al. (UCL), PLOS ONE 2023 — Warning: Humans cannot reliably detect speech deepfakes
• Fortune — Arup revealed as the victim of the $25 million deepfake scam in Hong Kong

Test my help desk with a vishing simulation