What Are Multimodal AI Social Engineering Attacks and How Do You Stop Them?

How do multimodal AI social engineering attacks work?

A multimodal AI social engineering attack builds one pretext and then supports it across several formats. A typical sequence starts with an email or chat message that sets up an urgent, confidential task. A voice note or call follows to add a familiar voice. A video meeting removes any remaining doubt, and a document such as an invoice, a board resolution or a bank letter supplies the payment details or access request.

The attack works because people treat agreement between channels as independent confirmation. If the email, the call and the meeting all say the same thing, the target assumes several people or systems have checked the story. In practice one actor wrote the script, generated the media and controls every account involved, so the apparent corroboration adds no evidence at all.

Generative tools lower the cost of each step. Text models write fluent messages in the target's working language, voice cloning needs a short sample of public speech, and real-time face swapping can run on consumer hardware during a call. The attacker no longer needs a skilled impersonator for each channel.

What recent cases and warnings show

The best documented example is the Arup fraud in Hong Kong. Hong Kong police said in February 2024 that a finance employee received a message that appeared to come from the company's UK chief financial officer, then joined a video conference with what looked like several colleagues. The employee transferred HK$200m to five local bank accounts in 15 transactions. Arup confirmed in May 2024 that it was the victim, as reported by The Guardian.

The FBI Internet Crime Complaint Center described the same pattern in public service announcement I-120324-PSA on 3 December 2024. It lists AI-generated text for social engineering, images for fake profiles and documents, audio clips that impersonate relatives or account holders, and videos used for real-time chats with supposed company executives or law enforcement.

A second FBI warning, I-051525-PSA from 15 May 2025, described a campaign that began in April 2025 in which actors impersonated senior US officials using text messages and AI-generated voice messages, then tried to move targets to another platform. The pattern of opening in one channel and shifting to another is the core mechanic of a multimodal attack.

Verify the action, not the media

The most reliable control does not depend on spotting a fake. Classify the request by its consequence first: a payment, a change of bank details, a password or MFA reset, a data export or a software install. Any request in those categories should be confirmed through a process the incoming messages cannot reach, such as a call to a number from the corporate directory or an approval inside the payment system.

Never use a phone number, link, meeting invite or account that arrived as part of the suspicious sequence. That rule alone would have broken the Arup chain, because the employee would have called the real CFO on a known line. Dual approval for high-value payments and a short hold on first-time beneficiaries add time for that check.

• Define which actions always need out-of-band confirmation, regardless of who asks.
• Keep a directory of verified numbers and approvers that staff can reach without the requester's help.
• Give staff explicit permission to delay a senior executive's request until verification is complete.
• Log which channel introduced each instruction so investigators can rebuild the sequence later.

Where deepfake detection helps and where it falls short

Detection adds a measurable signal when an artifact can be captured: a recorded voice note, a meeting recording, a profile photo, an attached image or a PDF. It is most useful after the fact, when an incident team needs to know which pieces were synthetic, and in workflows where media is already submitted for review, such as claims or onboarding.

It does not replace the action control. A real-time call may not be recorded, media quality may be too low to analyse, and a negative result on one clip says nothing about the email or the bank letter. NIST AI 100-4, published on 20 November 2024, makes a similar point: detection, provenance and watermarking each have limits and work best in combination.

Treat each result as evidence for one artifact. A synthetic finding on a voice note is strong grounds to stop and escalate. A clean result on a video frame does not clear a payment request that skipped verification.

Investigating a multimodal incident with NeuroDetect

Neural Defend built NeuroDetect for this kind of investigation. Analysts upload the authorized image, audio, video and document files from one incident into a single case. Each analysis keeps its model and version context, and the detailed views show where a finding comes from: explainability heatmaps and attention views down to image regions, video frames and audio segments.

An LLM-assisted summary describes the findings in plain language and links each statement to the underlying evidence, while the analyst makes the final call. The case can be exported as a forensic report covering observations, uncertainty, provenance, model context and analyst notes, plus structured results for a case management system.

The underlying detection comes from ARCAS 1B, Neural Defend's own deepfake detection model. The ARCAS paper reports pooled accuracy of 99.99% on GenImage and 97.74% on Community Forensics. On the public VendorBench-100 benchmark of 100 difficult still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next-best vendor. That benchmark covers images only, so audio and video findings should be judged on their own evidence views.

Running a cross-team exercise

A multimodal incident touches finance, the help desk, identity, communications and legal at once, so tabletop exercises should cross those teams. Build a scenario that starts with an email, moves to a voice note and ends with a meeting and an invoice, then measure how quickly staff pause the action, start independent verification and preserve the artifacts.

Assign ownership by outcome. Finance owns the payment hold and the bank recall, identity owns credential and factor changes, system owners contain compromised accounts, and the incident lead maintains a single timeline. Media analysts report what each artifact can and cannot support, which stops a single detection result from deciding the whole case.