Treat voice and video as unverified. The FBI warns that criminals use generative AI to clone voices and to produce real time video of supposed executives, so any request for money or access made by call needs a second, pre-agreed check, such as a callback to a known number.
What the FBI says
In a December 2024 public service announcement, the FBI says criminals use generative AI to make fraud more convincing and to run it at larger scale, and that the tools can remove the errors that often reveal scams. It describes short audio clips of a loved one's voice used to fake a crisis, AI-generated audio used to gain access to bank accounts, and videos for real time video chats with alleged company executives.
The PSA's advice is simple. Agree on a secret word or phrase to verify identity, look for visual flaws such as distorted hands, odd teeth or eyes and inaccurate shadows, listen for unnatural tone or word choice, and hang up and call back on a number you already know.
Why a policy beats a skill
Spotting flaws helps today and will help less over time. The FBI itself lists them as clues, but a policy does not depend on detection. It says that certain requests always get a second check, no matter how real the person looks or sounds.
A policy you can adopt
- Define the triggers. Payments, bank detail changes, gift cards or crypto, access grants, password or MFA resets, and urgent requests to bypass process.
- Require a callback to a number from your directory or contract, not one given in the call or message.
- Use a challenge phrase for executives and finance staff, agreed in person and changed when someone leaves. Do not store it in email or chat.
- Require a second approver for any payment or access change started by a call.
- Allow anyone to say no. Staff should know they will not be blamed for hanging up on a senior voice.
- Report attempts, even failed ones, so others get warned.
For engineering specifically
Deepfake attempts also target engineers: a fake manager asks for a production credential, a new SSH key or an urgent rotation of an API token over a call. Make those requests go through a ticket or the normal approval tool.
If your meeting software offers verified participants or lobby controls, turn them on for calls involving finance and access. Do not rely on the display name.
What not to claim
No detection tool is perfect. Avoid promising that a service will catch every fake. Build the process around the assumption that it can fail.
Quick check
Is a video call proof of identity?
No. The FBI describes real time video chats with alleged executives as a fraud technique. Use a separate verification step.
Where should the secret phrase be kept?
In people's memory or a secure vault, not in email or chat, where an attacker with mailbox access could read it.
Sources
Last reviewed: 19 October 2026.
