Deepfake social engineering attacks

Deepfake social engineering is manipulation that borrows a trusted face: an attacker appears on video as an executive, colleague, or vendor and uses that trust to push an employee into a transfer, a credential reset, or an access grant. It extends classic pretexting with synthetic media convincing enough to defeat visual judgment, stacking urgency and confidentiality to keep the target from verifying. Defenses combine process — out-of-band verification for sensitive requests — with in-meeting detection that flags the fake directly.

Training helps with process but not with perception. Employees can reliably learn to pause on urgent requests, verify through separate channels, and escalate anomalies — behaviors that stop many attacks however good the fake. What they cannot learn is to see deepfakes: modern face swaps eliminate the glitches older awareness material taught people to find. Effective programs pair the trained behaviors with algorithmic detection, such as Halo running during meetings, so identifying the synthetic face is not a human responsibility.

Urgent video requests should be verified through a channel the requester did not control: a phone number from the directory, a message in the corporate chat thread, or an in-person check — never contact details provided during the call. The policy works best unconditional, applied to every payment or access request above a threshold, because attackers engineer exceptions to feel justified. In-meeting detection strengthens the policy by flagging synthetic faces during the call, giving employees grounds to invoke it.