The FBI has described attackers who impersonate employees to persuade help desks to reset credentials and attackers who use synthetic voice or video to impersonate executives. In an FBI Ahead of the Threat discussion, investigators explain that personal knowledge questions may be answered from information attackers obtain elsewhere. A familiar face, voice, supervisor name, or biographical detail can make a request persuasive without making it authentic.
\r\nThe FBI’s 2025 impersonation alert reports malicious text and AI-generated voice messages impersonating senior officials and advises recipients to independently verify identity rather than assume a message is authentic. The FTC’s review of approaches to AI-enabled voice cloning says no single intervention solves the problem and discusses limitations and false results across detection and other technical approaches.
\r\nDSE recommendation: classify live and recorded audio or video as untrusted presentation, not identity proof. A detector may add a signal, but a sensitive action should be authorized by an independently authenticated person using an approved system of record. This article differs from DSE’s existing business-email-compromise guidance: it focuses on identity proof and action authorization when an attacker can convincingly reproduce a person’s voice or image.
\r\nMap each action to an authoritative request channel, required authentication, approver, separation of duties, evidence retained, and an alternate process for genuine emergencies. The requester must not be allowed to choose a new phone number, email address, messaging account, or colleague as the only verification route.
\r\nRoute instructions into the normal approval system and require the same authorization steps regardless of whether the request arrived by video conference, phone, text, or email. For a material change, call back through a known directory or confirm in an existing authenticated workflow. Verify the transaction details as well as the person: payee, account, amount, purpose, contract or invoice, and approving authority. An executive’s presence on video should not cancel dual approval or supplier bank-change validation.
\r\nNIST AI 100-4 surveys provenance and authentication, watermarking, detection, testing, and auditing for synthetic content. These techniques can contribute evidence, but coverage varies by content, generator, transformation, and operating condition. Validate any tool on the media and decisions where it will be used; document false-positive and false-negative consequences. Do not let a detector’s clean result authorize a reset or payment.
\r\nWhen impersonation is suspected, stop the action, preserve the original message and metadata, contact the real person through a known route, notify fraud or incident response, and follow reporting obligations. Avoid repeatedly forwarding sensitive media through consumer tools, which can lose metadata and expose information. The durable defense is a workflow that remains valid even when the voice and face are perfect.
\r\n