How to Run a Deepfake Readiness Drill to Test Verification Procedures
Summary
A practical guide to testing whether staff verify high-risk payment and access requests when faced with deepfake voice or video calls, using staged simulations, clear rules, measurement, and follow-up improvements.
Key points
- Map who attackers might impersonate and which employees can approve payments, reset MFA, or change access.
- Set verification rules before testing, including independently sourced callbacks for unusual payment, credential, or permission requests.
- Use consented voices, labeled synthetic stand-ins, or actors, and get approval from legal, HR, and executives before simulations.
- Start with a tabletop exercise, then run controlled live scenarios involving realistic email, chat, voice, or video sequences.
- Measure where verification breaks down, debrief participants without blame, fix process gaps, and repeat drills at least twice a year.
- The article says email security and real-time identity verification tools can support defenses, while emphasizing that process is central.
Article Details
- Defense Focus
- Test and strengthen organizational verification processes against deepfake voice and video impersonation used for payment fraud, help desk resets, and access changes.
- Detection Methods
- Run tabletop exercises followed by small-group live simulations using multi-channel scenarios that begin in email or chat and continue by voice or video.
- Verify unusual requests through a callback to an independently sourced phone number; do not rely on recognizing a voice or face.
- Use real-time identity verification that compares behavioral and biometric signals with a profile of the claimed speaker.
- Review drill break points, including skipped callbacks, communication-channel changes, and requests that exploit urgency or hierarchy.
- Data Sources
- Email and chat messages preceding voice or video requests
- Voice and video signals during collaboration-platform meetings
- Callback directory and independently sourced contact numbers
- Drill observations and participant actions
- Rule Types
- Behavioral email-security detection rules for unusual requests attributed to executives, managers, or vendor contacts
- Real-time voice and video identity-verification rules using behavioral and biometric signals
- Platforms
- Microsoft Teams
- Defensive Actions
- Map high-risk impersonation targets and likely recipients, including finance staff, help desk personnel, and identity administrators.
- Document verification rules before testing; require independent callbacks for unusual payment, credential, or permission requests.
- Obtain legal, HR, and executive approval before simulations involving an individual's identity; use consented voices, labeled synthetic stand-ins, or scripted actors.
- Debrief promptly and without blame, update callback directories and verification thresholds, and incorporate scenarios into regular phishing simulations.
- Repeat drills at least twice a year and when high-exposure personnel or circumstances change.
- Evaluate meeting-verification tools for privacy, including whether they retain recordings or transcripts.