Voice-clone phishing and deepfakes: an awareness plan your team will actually follow

• Text Fraudulent emails in flawless language, with the tone and signature of whoever they imitate.
• Voice A few seconds of public audio, from an interview or a LinkedIn video, are enough to generate a call in a director's voice.
• Image Video calls with faces generated in real time have already been used to authorise transfers at European companies.

What unites all three is not the technique: it is urgency combined with authority. Someone important wants something now, outside the normal procedure.

Training that only teaches detection will fail, because some fraud is undetectable. What works does not depend on detection: payments, changes to bank details and the sending of sensitive data are always confirmed through a second channel, to a contact already known.

A new IBAN in a supplier's email? Call the number in the contract. A transfer requested by the CEO on a video call? Confirm it by phone on his own number. If the rule is absolute — and management follows it too — the quality of the imitation no longer matters. We develop this point in our analysis of the altered-IBAN invoice fraud.

1. Short, themed sessions

An annual two-hour session is forgotten within a month. What works is 15 to 20-minute sessions every two or three months, one per theme: email, phone calls, video calls, social media, USB sticks and files. Always with real examples, ideally attempts that reached the company itself, anonymised — people remember the fake EDP email a colleague received, not a generic slide.

2. Simulations that teach rather than expose

Anyone who clicks receives a short, immediate explanation, never a public reprimand — fear leads people to hide things. And it is the reporting rate that is measured, not just the click rate: a company where 5% click and 60% report is better protected than one where 2% click and nobody says anything. Start with one simulation per quarter and raise the difficulty gradually.

3. Reporting in two seconds

A button in Outlook or an internal address everyone knows. Whoever reports should find out the same day whether it was fraud. Without a reply, people give up within a month; with one, the team becomes the company's fastest sensor.

4. A script for deepfakes

• Accept reality The right voice and face guarantee nothing; that is the current state of the technology.
• Warning signs A request outside procedure, haste, a request for secrecy, refusal of the usual channel. Useful, but not sufficient.
• Standard response I'll confirm with you right away through the usual channel, and hang up. If management says this out loud in the training, the team will do it without fear.
• Verbal password Agreed between management and finance for requests involving money: simple, costless and effective.

• Finance and accounts Transfers.
• Human resources Personal data and changes to salary accounts.
• Reception and executive assistants Diaries and requests on behalf of others. In the embassies, clinics and hotels we manage, reception is often the first target.
• Management Receives the most personalised attacks and is the least likely to attend training.

Training is the last line of defence. Before it there should be: email filtering that flags external messages and blocks executable attachments; SPF, DKIM and DMARC to make it harder to send email in the company's name; and multi-factor authentication so that a stolen password is not enough. On top of these come managed firewalls and Microsoft 365 protection.

As part of DataRoad's managed cybersecurity, we prepare the initial session, the first simulation and the report button, and configure filtering and MFA so that less fraud reaches people. In 11 years, DataRoad has never suffered a security incident.

More than 10 workstations · support contract · remote, on-site and telephone support

+351 211 459 950* · sales@dataroad.pt

*Call to a Portuguese landline.