Your finance team gets a call from the CEO. There’s a problem with a vendor payment. He’s traveling, doesn’t have access to everything he normally would, and needs someone to take care of it quickly. The voice sounds like him and the request sounds plausible. He even references a project your team knows about. Would your employee question it?
A familiar voice used to provide a certain level of reassurance. As artificial intelligence makes it easier to create convincing audio, video and written communications, that assumption is becoming increasingly risky.
Impersonation Is Getting Harder to Spot
Impersonation isn’t a new cybersecurity tactic. Attackers have long pretended to be executives, vendors, coworkers and IT personnel to convince employees to transfer money, provide credentials or grant access. What’s changing is how convincing those interactions can be.
Artificial intelligence can help attackers create more believable messages, replicate voices and produce synthetic images or video. Microsoft has observed threat actors using AI-generated voice cloning to impersonate executives and trusted individuals in vishing and business email compromise schemes. The FBI has also warned about malicious actors using AI-generated voice messages to impersonate trusted individuals. In one campaign, attackers impersonated senior U.S. officials through text and AI-generated voice messages to establish trust and gain access to accounts.
The threat isn’t limited to a perfectly cloned voice. Attackers may impersonate an employee when calling the IT help desk and request a password reset or change to multifactor authentication. They may pose as IT support and ask an employee to provide a one-time passcode or approve an MFA notification. According to the Center for Internet Security, these types of vishing attacks have been observed throughout 2026, as attackers increasingly target the trust between employees and the people they interact with every day.
When Familiar Isn’t Enough
For years, employees have been taught to watch for signs that something isn’t quite right. Are there spelling mistakes in the email? Is that the sender’s usual address? Does the person sound like themselves? Is the request typical or expected? Those are still useful questions, but increasingly sophisticated impersonation means organizations can’t depend on employees being able to recognize every fake.
A convincing voice isn’t proof of identity. Neither is a familiar name on a screen. Even a professional-looking email can be deceptive. Even knowing details about an employee, executive, vendor or current project isn’t necessarily proof. Information available through websites, social media, compromised accounts and other public or stolen sources can make an impersonation attempt significantly more convincing.
That changes the question employees need to ask. Instead of “Does this seem like them?”, the better question is: “Can I independently verify that this is them?”
Trust the Process, Not Just the Person
Organizations can reduce the risk of impersonation by establishing verification procedures before an unusual request arrives. Consider a request to change a vendor’s banking information. Even if the request appears to come directly from a known vendor contact, there should be a defined process for independently verifying the change. That might mean calling the vendor using a phone number already on file rather than one included in the request.
The same principle applies internally. A request from an executive to initiate an unusual payment may require confirmation through another established channel or approval from a second person. A help desk receiving a request to reset credentials or change MFA settings should have an identity-verification process that doesn’t depend solely on the caller knowing personal information.
Employees receiving unexpected requests for passwords, one-time codes or MFA approvals should know that legitimate urgency doesn’t eliminate the need to follow security procedures. The exact controls will look different for every organization. The important part is that verification isn’t improvised in the moment.
Urgency Should Be a Reason to Verify, Not a Reason to Skip It
Social engineering often works because it creates pressure. This needs to happen now. I’m about to board a plane. The customer is waiting. Don’t bother anyone else with this. I’ll explain later. Urgency can push someone to bypass a process they would normally follow, particularly when the request appears to come from a person with authority.
Organizations can help by making one expectation clear: Security procedures still apply when the request comes from leadership. Employees should feel comfortable slowing down an unusual request without worrying that they’ll be criticized for questioning an executive, customer or senior colleague. Leadership can reinforce that culture by following the same verification procedures themselves.
Create Verification Procedures Before You Need Them
Organizations don’t need an elaborate process for every communication. But higher-risk actions should have clear safeguards. Start by identifying the types of requests where impersonation could cause significant harm:
- Wire transfers and other financial transactions
- Changes to vendor payment information
- Password resets
- MFA enrollment or changes
- Requests for credentials or one-time codes
- Access to sensitive systems or data
- Disclosure of confidential information
- Changes to employee or customer account information
Then determine what additional verification is required. That could include a callback to a known number, confirmation through a separate communication channel, two-person approval or an established internal verification procedure. Most importantly, employees need to know that they’re expected to use those safeguards even when the person making the request sounds convincing.
When You Can’t Trust What You Hear
AI doesn’t fundamentally change the goal of social engineering. Attackers are still trying to convince someone to trust them long enough to provide access, information or money. What AI changes is how convincing that person can appear.
Organizations can’t expect every employee to become an expert at identifying an AI-generated voice, manipulated video or carefully crafted impersonation attempt. As the technology improves, spotting the fake may become increasingly difficult. A stronger defense is to build processes that don’t require employees to make that determination on their own.
At 360 Security Services, we help organizations identify vulnerabilities in both their technology and their security practices, from cybersecurity assessments and penetration testing to security awareness and incident response planning. When a familiar voice is no longer enough to prove who’s on the other end, a strong verification process matters. Let’s talk.