Deepfake Phishing Emails: How to Spot and Report Them in Your Organization

At 4:50 on a Friday, the accounts payable lead gets a message that sounds exactly like the CFO: a short voicemail, a familiar cadence, a request to move a vendor payment before the bank closes. Nothing in the inbox screams "scam." That is the point. Cloned voices and manipulated video now travel inside perfectly ordinary business email, and the requests they carry are built to survive the skepticism most people apply to a strange link.

The good news is that the underlying fraud has barely changed. Only the packaging did. Which means the habits you already trust — verify, slow down, report — still work. What follows is how to spot the tells, how to check a request without insulting anyone, and how to route a report so it does something useful.

Why a Familiar Face Changes the Math

Ordinary phishing asks you to believe a story. A deepfake request asks you to believe your own eyes and ears. When a message arrives with a short audio clip or a video attachment, the brain treats the medium as evidence and skips the part where it questions the sender.

Attackers do not need a studio. Webinar recordings, conference talks, sales calls, and voicemail greetings are often public or easy to obtain. A few seconds of clean speech is enough to build a plausible voice; a short clip of someone speaking to camera is enough to seed a looping video call. The target is rarely the executive whose face is being used. It is the person with payment authority, mailbox access, or a help desk password reset.

Red Flags in the Message Itself

Context still beats technology. Before you judge the audio, judge the request.

• Urgency plus secrecy. A deadline measured in minutes, a "keep this between us," or a warning not to loop in the usual approver.
• A channel switch. Real payables workflows do not move to a personal address, a chat app, or a text message at the last minute.
• A first-time ask. Someone who always delegates payment changes suddenly doing it personally.
• Wrong tone or wrong register. Missing internal shorthand, unusual formality, or a greeting the person never uses.
• Lookalike addresses. A swapped letter, an added hyphen, a free mail domain, or a reply-to that differs from the visible sender.
• Timing. Late Friday, the day before a holiday, or the hour when the approver is known to be traveling.
• New banking details. Any change to vendor payment instructions should trigger a call, no matter how good the voice sounds.
• Destinations. A "secure portal" on a domain you have never seen, or a document that needs macros enabled to view.

Listening and Watching for Artifacts

Audio

Cloned speech tends to be too even. Breath sounds go missing, or they appear in the wrong places. Background noise stops abruptly at the end of a sentence instead of continuing underneath. The speaker does not pause to think, does not interrupt, and does not react when you talk over them. There is often a small, unnatural delay before each reply, or a clicking transition where clips were stitched together. Pitch may drift slightly on longer words.

Video

Watch the mouth and the edges. Lips drift out of sync after a few seconds. Teeth smear or blur, hair edges shimmer, and glasses reflections do not match the light source. Blinks are too rare or too regular, and the face may freeze for a fraction of a second during movement. Hands are often hidden or awkward, and the background warps subtly near the head and shoulders. Mixed audio — one voice from a phone line, another from a studio microphone — is a strong signal.

Set the bar sensibly: if the only thing wrong is a feeling, that feeling is enough to justify a verification call. You are not accusing anyone. You are following procedure.

Verify Out of Band: The Two-Channel Rule

Any request that moves money, changes credentials, or grants access must be confirmed on a second channel that the requester did not choose.

1. Call the person back on the number in your directory or their published internal profile — never the number in the message.
2. If they are unreachable, contact a second person in their team or their manager. A request that only works when one person is alone is not a real request.
3. For payment changes, verify with the vendor through a contact you already have on file, and confirm the new account details by voice with a known individual.
4. Use a shared verification phrase for high-risk approvals. It should be something you would not say in a meeting or write in an email.
5. If pressure increases when you ask to verify, stop. Legitimate urgency survives a five-minute delay; manufactured urgency does not.

How Employees Should Report

Speed matters more than completeness, but a report with details saves hours of investigation.

1. Do not reply, and do not forward it to colleagues with "did you get this?" That spreads the message and can confuse the trail. Report it instead.
2. Use the report button in your mail client if one exists. If not, send it as an attachment to your security or phishing mailbox rather than pasting a screenshot.
3. Include the sender address, the exact time you received it, everyone on the thread, and any attached audio or video file. Preserve voicemails rather than deleting them.
4. State plainly what you did: opened nothing, clicked nothing, or entered credentials. There is no reason to soften this part — the response changes completely if a password was typed in.
5. If money moved or credentials were entered, call the security team or the service desk immediately rather than waiting for an email response. Bank recalls and password resets are time-sensitive; involve your finance leadership and, where funds left the organization, your bank and legal counsel without delay.
6. Tell your manager if you were targeted, so the same approach against a colleague does not catch anyone off guard.

What Happens After the Report

A good security team treats the report as intelligence, not as a nuisance. Expect them to preserve the original message and any media file, extract the sending infrastructure, and search for the same sender or attachment across all mailboxes. They will block the domain, alert anyone else who received it, and contact the executive or vendor whose identity was borrowed so that person is not blindsided by a follow-up call.

If payment details were changed, the team works with finance and the bank on recalls and on notifying the real vendor. If credentials were entered, sessions get revoked and passwords reset. Reports that turn out to be false alarms are still welcome — a culture where people hesitate before reporting is far more expensive than one where they report too often.

Build a One-Page Playbook and Rehearse It

Write down four things and put them where people will actually see them: how to report, who to call when money is involved, the two-channel verification rule, and the fact that nobody gets blamed for stopping a payment to check. Print it. Pin it near the finance desk.

Then rehearse it once a quarter with a harmless drill: a test message, a test call, a short debrief. The goal is not to turn everyone into a forensics analyst. It is to make verification so routine that a cloned voice in your inbox feels less like a crisis and more like a form that needs a second signature.

Photo: pixelcreatures / Pixabay