How AI Impersonation Attackers Research Targets and Build Pretexts

How do AI impersonation attackers build pretexts?

AI impersonation attackers build pretexts in two stages. First they research the person they will impersonate, usually a senior executive, a finance lead, a vendor contact or a family member. Then they research the target, the person who can move money, reset access or share data. The pretext connects the two with a believable story: a confidential acquisition, an overdue supplier invoice, a locked account during travel or a family emergency.

Generative AI changes the second half of the job. Once the attacker knows who to impersonate, conference talks, earnings calls, podcasts and social videos supply the audio for a voice clone and the footage for a face model. Text models write messages in the right tone and language. The research decides who to fake; the tools make the fake cheap.

The pretext also chooses the channel. Attackers prefer channels where the target cannot easily check identity, such as WhatsApp, Signal, SMS or a personal email, and they time requests around travel, holidays and the end of a quarter, when approvers are hard to reach.

What the WPP case and FBI alerts show about reconnaissance

The attempt against WPP, reported by The Guardian on 10 May 2024, shows research turned into a pretext. Fraudsters created a WhatsApp account using a public image of chief executive Mark Read, set up a Microsoft Teams meeting that appeared to include him and another senior executive, and used a voice clone and YouTube footage of the executive during the call. They asked an agency leader to set up a new business, in order to obtain money and personal details. The attempt failed.

The FBI described similar mechanics in alert I-051525-PSA on 15 May 2025. Since April 2025, actors had sent texts and AI-generated voice messages that claimed to come from senior US officials, to build rapport before sending a malicious link framed as a move to another messaging platform. The alert notes that scammers incorporate publicly available photographs, use minor alterations in names and contact details, and use AI-generated voices to pose as a known contact.

In both cases the media were only one part. What made them work was knowledge of who the target trusted and which channel that person would accept.

Early contacts that test the pretext

Before the real request, attackers often send a harmless message to check that the address works, that the target replies quickly and that the claimed relationship is accepted. A short exchange about a subject the target knows also creates a message history, so the later request looks like part of an existing conversation.

Watch the small steps as well as the final ask. A request for a personal mobile number, a move to an encrypted app, the name of a colleague in finance, a copy of an internal template or a one-time code each moves the pretext forward. Staff should feel free to verify these before the conversation turns urgent.

• A first message from a new number or account that claims an existing relationship.
• An immediate suggestion to continue on WhatsApp, Signal or Telegram.
• Questions about who handles payments, approvals or account recovery.
• Requests for a code, link click or document before any business is discussed.

Reducing exposure without going dark

Executives and companies need a public presence, so the goal is to remove useful detail, not visibility. Review public material by consequence: does it reveal who approves payments, when a leader will be away, which vendor bank is used, how account recovery works or which personal app someone prefers. Those details give an attacker a script. Keynote videos and press photos are harder to avoid and matter less once verification does not depend on recognising a face or voice.

Treat breached and brokered data as already public. Personal phone numbers and home addresses of executives and finance staff are often for sale, so a call to a personal phone does not show that the caller has inside access. Data-broker removal services and stricter directory access help at the margin.

Verification that a pretext cannot pass

Verification should use information the attacker cannot have gathered. Call back on a number from the internal directory that existed before the contact, confirm the invoice change with the vendor record owner, and check meeting invitations against the corporate calendar. Questions about public trivia, such as a pet's name or a recent trip, test nothing.

Tie the check to the requested action. A payment needs confirmation from the payment approver inside the payment system. An access reset goes through the registered recovery process. This checks authority and identity in one step and stays valid however good the voice clone is.

Where Neural Defend fits once a pretext reaches you

When a pretext produces artifacts, such as a voice note, a recorded meeting, a profile picture or a forwarded document, analysis can confirm whether they were synthetic and support the incident record. Neural Defend's NeuroDetect is a forensic workspace for authorized image, audio, video and document files. Analysts get heatmaps and attention views down to frames and audio segments, a plain-language summary linked to the evidence, and a downloadable report with observations, uncertainty and model context.

For contact centres and phone-based approvals, NeuroCall, currently in Beta, focuses on voice and call deepfake detection. Both products rest on ARCAS 1B, Neural Defend's own detection model, and are available as a managed cloud service or deployed in a private cloud, on premises or air-gapped. Detection confirms what an artifact is; it does not stop an attacker who never sends a file, which is why the verification steps above come first.