Cloned Voices Are Calling: Why Your Business Needs a Deepfake Drill

Imagine the CFO phones the controller at 4:40 on a Friday, rushed and apologising for a bad connection, and asks for a supplier payment to go out before the weekend. Ten minutes later an email arrives with the wire details. The voice may be a clone. What was once a conference talk now appears in incident reports. In a 2025 Gartner survey of 302 cybersecurity leaders, 62% said their organisation had faced at least one deepfake attack in the prior 12 months, 43% reported a deepfake audio call incident, and 37% had encountered deepfakes on video calls.

Payments are only the obvious target. The same cloned voice could call a help desk to move an MFA token, or ask an identity admin to create a new global admin ahead of an "audit." A fraudulent wire tends to surface at reconciliation, but a quietly added admin account can sit unnoticed for months. Many organisations have a policy to verify unusual payment and access requests, yet far fewer have tested whether it holds up against a call from someone who sounds like the person who approves everything.

Traditional awareness training teaches staff to spot tells such as awkward phrasing or odd sender addresses, but voice clones and real-time face swaps leave fewer of these each quarter. In a May 2025 warning, the FBI said cloned voices can sound nearly identical to the real person and advised confirming identity by calling an independently sourced phone number. A January 2026 Osterman Research study of 128 US leaders, commissioned by IRONSCALES, found 60% lacked confidence in countering deepfake attacks even with existing training. A readiness drill shows where verification breaks down, with nothing real at stake.