As synthetic audio and video undermine trust in workplace communications, research points to a shift from recognizing familiar faces to independently verifying identities and high-risk transactions.
A familiar voice on a business call once served as informal reassurance about someone’s identity. Now, artificial intelligence can reproduce that voice convincingly enough to make ordinary workplace trust a potential security weakness.
In a September 2026 survey, Gartner reported that 41% of chief information security officers (CISOs) had encountered at least one social-engineering incident involving a deepfake during an employee audio call in the preceding year. Another 36% reported incidents involving video calls.
The findings, drawn from 297 CISOs and equivalent cybersecurity leaders surveyed between March and May, measure reported incidents, not confirmed financial losses. Nevertheless, they reveal a growing problem for enterprise security: the person appearing on screen may not be the person authorizing an action.
When a Video Meeting Becomes a Fraud Channel
The danger is no longer theoretical. In January 2024, an employee in Hong Kong received a phishing email impersonating a UK-based chief financial officer, joined a purported confidential video meeting, and authorized transfers to five local bank accounts.
The organization lost approximately HK$200 million, according to an official Hong Kong government account. Police believed the conference was prerecorded using publicly available video and audio of the impersonated executive; there had been no genuine interaction with the supposed participants.
The case exposes an important distinction. The attack did not require criminals to break into a payment platform. Instead, an employee authorized to transfer funds was persuaded that the instructions came from someone legitimate.
This is why digital identity is becoming a transaction-security problem, not merely a question of whether someone can log in.
Why Humans Struggle to Recognize Cloned Voices
Voice impersonation works partly because listeners rely on acoustic cues such as timbre, rhythm and speaking style when identifying familiar people. Generative models can synthesize many of those characteristics without reproducing the original speaker.
In a 2023 PLOS ONE experiment, Kimberly T. Mai, Sergi D. Bray, Toby Davies and Lewis D. Griffin tested 529 listeners using genuine and synthetic English and Mandarin speech. Participants correctly identified deepfake recordings 73% of the time, with little improvement after hearing examples.
More recent research in Scientific Reports, by Sarah Barrington, Emily A. Cooper and Hany Farid, found that participants judged an AI-generated voice to belong to its real-life counterpart approximately 80% of the time. They correctly classified voices as AI-generated only about 60% of the time.
These experiments used controlled listening tasks rather than live corporate fraud attempts. Their significance is not that every imitation will succeed, but that even attentive listeners can mistake synthesized speech for genuine communication.
The Attack Surface Extends Beyond the Call
The World Economic Forum’s Global Cybersecurity Outlook 2026 describes criminals using generative AI to produce credible phishing messages, deepfake audio and video, and falsified documentation.
An impersonator may exploit information from corporate websites or social profiles, combine it with a realistic voice, and then apply urgency through email, messaging or a meeting invitation. These are familiar social-engineering tactics made more persuasive by synthetic media.
Gartner director analyst Craig Porter warned that attackers can combine business email compromise, synthetic media and personal context across communication channels. The survey also found that 79% of CISOs reported email phishing, spear-phishing or business email compromise, compared with 58% reporting voice or SMS phishing.
For security teams, the lesson is that deepfake defense cannot exist as an isolated video-filtering feature. It must connect identity, communication, account recovery and payment controls.
Detection Is Necessary but Not Sufficient
The Scientific Reports researchers noted that many forensic techniques analyze recordings after the fact rather than while a phone or video call is underway. They also warned that real-time analysis raises privacy concerns and that false alarms could undermine confidence in detection tools.
Even a detector that flags suspicious audio cannot prove that an instruction is authorized. An authentic executive might make a mistaken request; a fraudulent actor might use a compromised legitimate account without a deepfake at all.
Effective defenses therefore need to distinguish media authenticity, account authentication and transaction authorization. These are related questions, but they are not interchangeable.
Authentication Must Move Beyond Appearance
The US National Institute of Standards and Technology addresses this problem in its 2025 digital identity guidance. NIST warns that attackers can inject modified images or videos between a capture device and verification software, defeating some checks based on comparing a face with an identity record.
Its guidance calls for controls that establish whether media originates from a genuine sensor, analysis for manipulation and authenticated communication channels. It also recognizes that presentation-attack detection cannot prevent every forged-media attack.
For account access, FIDO Alliance passkeys use cryptographic key pairs and challenge-response authentication rather than reusable passwords. This reduces credential-phishing risk but does not automatically prevent an authenticated employee from approving a fraudulent instruction.
That distinction is crucial. A signed-in finance officer can still be manipulated by a convincing caller.
The Next Security Layer Is Transaction Verification
Organizations should treat unusually large transfers, changes in beneficiary details, privileged-access requests and account recovery as actions requiring independent verification.
That means confirming sensitive instructions through previously established channels, requiring additional authorization for high-risk payments, and linking security alerts to unusual account or device activity.
These priorities echo Gartner’s recommended response: strengthen phishing-resistant workforce identity, build trusted verification routes and correlate suspicious communications with financial transactions.
For founders developing identity technology, the commercial opportunity is therefore larger than detecting artificial faces. Businesses need systems that establish who controls an account, who initiated a request and whether the resulting action has been independently authorized.
The emerging cybersecurity standard is not whether a caller looks or sounds authentic. It is whether the organization can verify the identity, authority and transaction without having to trust the call itself.
