Deepfake Voice Phishing (Vishing) in the Financial Sector

What deepfake voice phishing looks like in the financial sector

Deepfake vishing in financial services is voice phishing in which the caller uses an AI-cloned or AI-converted voice to impersonate someone the target trusts. Traditional vishing relied on a confident stranger claiming to be from the bank's fraud team. The deepfake version adds a familiar voice: the customer's own voice played to the bank, the chief financial officer's voice played to a treasury analyst, or a relationship manager's voice played to a wealthy client.

Financial institutions are exposed on both sides of the call. Customers receive cloned calls that push them to move money or reveal codes, and bank staff receive cloned calls from people pretending to be customers, colleagues or executives. The FBI's December 2024 public service announcement names cloned audio used to gain access to bank accounts as a current technique, and FinCEN's November 2024 alert FIN-2024-Alert004 warned financial institutions about fraud schemes using deepfake media created with generative AI.

Four deepfake vishing scenarios banks should plan for

The scenarios below cover most cases seen in public reporting and regulator warnings. Each needs a different owner inside the bank.

Which bank controls deepfake vishing defeats

Voice biometrics is the most obvious casualty. In February 2023 a Motherboard journalist reported accessing his own Lloyds Bank account by phone using a clone made from about five minutes of his speech; the only other check was his date of birth. NIST's SP 800-63B-4, finalised in July 2025, now states that voice biometric comparison shall not be used in its authentication guidelines.

Knowledge-based questions are the second. Dates of birth, addresses and recent transactions can be found in breached data or extracted earlier in the same campaign. Caller recognition by staff is the third: an agent who has spoken to a client many times is more likely to trust a familiar voice and skip a step.

Callback to a known number, app-based approval and dual control survive because they do not depend on the voice at all. Those are the controls to strengthen first.

How financial institutions can reduce deepfake vishing losses

Start with the decisions a phone call can trigger and remove voice as the deciding factor for each one. Then add detection where volume makes manual review impossible.

• Require in-app approval or a callback to the number on file before payee additions, limit increases, contact detail changes and password or device resets requested by phone.
• Run synthetic-speech detection on contact-centre calls that reach authentication or request sensitive changes, and route high-risk calls to trained agents.
• Add scam-specific warnings and short holds to unusual urgent transfers, especially for older customers and first-time payees.
• Train treasury, payments and private banking staff that a familiar voice never replaces the written approval process.
• Agree a playbook with fraud operations for stopping and recalling payments within minutes of a reported scam.
• Preserve call recordings in original form so investigations and dispute handling have usable evidence.

Regulatory signals on synthetic voice in finance

Regulators have moved from general warnings to specific expectations. FinCEN's November 2024 alert set out red flags for deepfake media and asked institutions to report related suspicious activity. In the US, the FCC confirmed on 8 February 2024 that AI-generated voices are artificial voices under the TCPA, so robocalls using them need prior express consent, which gives banks and carriers a clearer basis to act against cloned robocall campaigns.

Customer-facing guidance points the same way. The FBI recommends hanging up and calling the bank back on a number you look up yourself, and never sharing one-time codes. Starling Bank's September 2024 survey found 28% of UK adults said they had been targeted by an AI voice cloning scam in the past year, which suggests customers expect their bank to help.

How to tell whether your vishing controls are working

Most banks cannot say how many deepfake calls they receive, because a successful clone looks like a normal call in the logs. Build measurement in from the start. Track how many sensitive phone requests were stepped up, how many step-ups the caller abandoned, and how many confirmed fraud cases began with a call that passed authentication.

Run controlled tests as well. With legal and compliance approval, have a red team place cloned-voice calls against your own contact centre, help desk and treasury approval lines using consenting staff voices. The results show which processes still accept a voice as proof and give the board a concrete measure of progress, rather than a general statement that the risk is being managed.

How Neural Defend helps banks detect deepfake vishing

Neural Defend's NeuroCall, currently in Beta, screens call audio for synthetic speech and returns a risk signal for the bank's call-handling and fraud rules, so a high-risk call can be held for callback before any account change or payment. NeuroVerify covers digital channels, checking face images, video and audio in one API request during onboarding and account recovery, and NeuroDetect gives fraud investigators audio-segment evidence and a forensic report for disputed calls.

For banks with strict data rules, deployment options include private cloud or VPC, on-premises and air-gapped installs, and Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certification.