Deepfake vishing is a voice-phishing attack in which an attacker uses an AI-cloned voice, often paired with deepfake video, to impersonate someone the victim trusts and pressure them into moving money or handing over credentials. In early 2024 a single deepfake video call cost the engineering firm Arup 25.6 million dollars across fifteen transfers in one day. Voice cloning now needs only seconds of sample audio, and the tactic is scaling faster than any phone-based control was built to handle.
What is deepfake vishing?
Vishing is voice phishing: a social-engineering attack delivered over a phone or video call rather than an email. Deepfake vishing adds a synthetic, AI-generated voice, so the person on the line sounds exactly like your finance director, your bank, or your IT helpdesk. The attacker is not doing an impression. They are replaying a machine-cloned version of a real person, rebuilt from audio that person published themselves.
The shift matters because the phone still carries social trust that email lost a decade ago. Staff are trained to distrust links and attachments. They are rarely trained to distrust a familiar voice giving an urgent instruction. That gap is precisely what synthetic-voice fraud is built to exploit, and it sits in the same family as the AI-generated phishing we have covered before, just moved from the inbox to the handset.
How a voice clone is built
The raw material is public. Earnings calls, conference talks, podcast appearances, webinars, voicemail greetings, and social video all provide clean speech samples. Commercial voice-cloning tools now advertise convincing results from as little as three seconds of reference audio, and the better ones support real-time conversion, so the attacker speaks and the victim hears the target.
Group-IB, which has documented the anatomy of these scams, describes a repeatable pipeline: harvest a voice sample, clone it, write a high-pressure script, spoof the caller ID to a trusted number, and call during a moment engineered for urgency. The voice is the trust anchor. The script does the rest, usually some variation of a confidential deal, a payment that must clear today, or a password reset that cannot wait.
The Arup case: 25.6 million dollars in a day
The clearest worked example is the Arup fraud. A finance employee in Hong Kong received an email about a confidential transaction and suspected phishing. The attackers then invited the employee to a video call. On that call were people who looked and sounded like the company chief financial officer and several colleagues, all of them deepfakes assembled from publicly available footage. Reassured, the employee executed fifteen wire transfers totalling roughly 25.6 million dollars (200 million Hong Kong dollars). The fraud surfaced only when the employee later checked with corporate headquarters. As of early 2025 none of the money had been recovered.
Arup is not an outlier of capability, only of disclosure. It is the case that became public. The same toolchain is available to far less sophisticated crews.
Deepfake fraud by the numbers
Pindrop reported synthetic voices in a rising share of contact-centre traffic through 2024, up 173 percent across the year. Deloitte’s Center for Financial Services projects generative-AI-enabled fraud in the United States climbing from 12.3 billion dollars in 2023 to 40 billion dollars by 2027. The direction of travel is not in dispute.
Why it defeats the controls you already have
Most phone-fraud controls assume the caller is a human who might be lying, not a machine that sounds identical to someone you trust. Caller ID is trivially spoofed. A callback to a known number is defeated when the attacker manufactures enough urgency that the victim skips it, or when the deepfake is convincing enough that verifying feels insulting. Push-based MFA never enters the picture, because the fraud targets a human decision (approve this wire) rather than a login. Even voiceprint biometrics, once treated as a backstop, are now in scope: the same cloning that fools a person can be tuned to fool a verification model.
This is the same structural lesson as MFA fatigue: the control was built for a threat model the attacker has already stepped around.
How attackers pick and prime a target
Targeting is open-source intelligence work. Attackers map who in an organisation can move money, who they report to, and when the usual approver is unreachable. A CFO speaking at a conference is both a voice sample and a window of plausible absence. Recent mergers, new vendor relationships, and quarter-end deadlines all become ready-made pretexts. The reconnaissance overlaps heavily with the shadow-AI and data-exposure problems we track, because every leaked org chart and exposed calendar shortens the attacker’s homework.
What defenders should do
The fix is process, not gadgetry. Require out-of-band verification for any payment instruction or credential change that arrives by voice, using a channel agreed in advance, never a number supplied during the call. Adopt a challenge phrase or shared codeword for high-value finance requests, the verbal equivalent of a second factor. Enforce dual authorisation above a transaction threshold, so no single convinced employee can move large sums alone. Train finance and executive-assistant teams specifically on this scenario, because they are the front line. Where practical, reduce the volume of high-quality executive audio and video sitting in public, which is the attacker’s clone library. For customer-facing call centres, deploy liveness and anti-spoofing detection on high-risk call flows.
What this means for security teams
Deepfake vishing is not a future risk to monitor. It is a present-tense fraud with a confirmed eight-figure loss and a falling cost of entry. The uncomfortable part is that it bypasses technology by attacking trust, so the strongest defence is a verification habit that survives a familiar voice telling you to skip it. Treat the phone the way your staff already treat email: as a channel that can lie. Our AI desk will keep tracking the tooling as it commoditises further. For more on the model-security side of this shift, see our AI coverage.
FAQ
What is deepfake vishing?
Deepfake vishing is voice phishing that uses an AI-cloned voice, sometimes with deepfake video, to impersonate a trusted person and pressure a victim into a payment or credential disclosure. It combines synthetic media with classic social-engineering urgency.
How much audio do attackers need to clone a voice?
Modern voice-cloning tools advertise convincing results from as little as three seconds of clean reference audio. Public sources such as earnings calls, podcasts, and conference talks usually supply far more than that.
Is deepfake vishing actually causing losses?
Yes. The Arup case alone cost roughly 25.6 million dollars across fifteen transfers in a single day, and none of it was recovered. Industry projections put generative-AI-enabled fraud in the tens of billions of dollars by 2027.
Does MFA stop deepfake vishing?
Not on its own. The attack targets a human decision, such as approving a wire transfer, rather than a login, so login-based MFA never enters the loop. Out-of-band verification and dual authorisation are more effective.
How do we protect our finance team?
Require out-of-band verification on a pre-agreed channel for any voice request to move money or change credentials, use a shared challenge phrase, enforce dual authorisation above a threshold, and train staff on this specific scenario.
Can voice biometrics detect a cloned voice?
Increasingly less reliably. The same cloning quality that fools a human can be tuned against verification models, so voiceprints should be one signal among several, not a sole backstop.
Sources and further reading
- Arup deepfake CFO fraud: Fortune and the World Economic Forum, 2024 to 2025.
- Voice-deepfake attack anatomy: Group-IB threat research.
- Vishing growth: CrowdStrike 2025 Global Threat Report.
- Synthetic-voice call-centre data: Pindrop.
- Generative-AI fraud projection: Deloitte Center for Financial Services.
- Related on Ransomnews: Detecting AI-generated phishing, MFA fatigue attacks, our editorial team.