How can we effectively train employees to identify sophisticated deepfake voice phishing attacks?

All answers to this question.

To combat AI-driven vishing, you must move beyond static slide decks. Start by implementing 'verification catchphrases' or out-of-band authentication for any financial or data-sensitive requests, regardless of who the caller claims to be. We run live simulations where employees receive spoofed calls in a safe environment. This builds muscle memory. Additionally, teach them to listen for unnatural prosody or robotic artifacts common in current AI voice clones. It’s about creating a culture where 'trust but verify' is the standard operating procedure for every single department.

   Answered 2024-05-18 by Emily Thompson

This is a huge concern for us too, but have you considered how these attackers are getting the voice samples to train their models in the first place?

   Answered 2024-05-20 by Michael Ross

• Michael, they usually scrape LinkedIn for public speaking clips or executive interviews on YouTube. To mitigate this, we’ve started advising our C-suite to limit public audio exposure or use privacy settings. We also use multi-factor authentication for all wire transfers to bypass the need to 'trust' a voice alone.

     Commented 2024-05-22 by David Miller

We found that the most effective method is a 'no-blame' reporting culture. If an employee feels a call was 'off,' they should be rewarded for reporting it immediately.

   Answered 2024-05-25 by Jessica Williams

• I agree with Jessica; a positive reporting culture is much more effective than 'gotcha' style testing which can sometimes alienate the staff from the security team.

     Commented 2024-05-27 by Sarah Jenkins