Deepfakes are the new spear-phishing

Deepfakes are the new spear-phishing

Voice cloning and synthetic video did not create a new crime. They upgraded the oldest one.

DEEPFAKES / 2026-09-02

Phishing has always been a confidence game: an attacker pretends to be someone you trust and asks for something real. What changed is the costume. AI voice cloning can reproduce a person's voice from seconds of public audio, and synthetic video can put words in anyone's mouth. The attack is not new. The believability is.

The mechanism

The modern play runs in stages. First, collection: attackers harvest voice samples from public appearances, podcasts, and leaked voicemail, plus context from the target's social graph. Next, impersonation: a cloned voice calls an assistant, a family office, or a vendor, sounding exactly like the principal. Last, execution: the ask is time-sensitive, privileged, and routed away from the channels that would catch it, toward a new bank account or a transfer.

Why it works

  • Voice is a trust shortcut; humans authenticate people by ear, not by certificate
  • The context is scraped from real life, so the story checks out
  • The ask is urgent, which suppresses the two-question check
  • The channel is unusual, which routes around the assistant who knows the principal's voice

Why principals are the target

A deepfake of a stranger is a curiosity. A deepfake of a founder or a public figure is a weapon: it can move money, move markets, or move a reputation. Executives and their households are targeted precisely because their voice carries authority and their network is conditioned to say yes. The FBI's Internet Crime Complaint Center recorded reported losses exceeding $16 billion in 2024, up sharply in a single year, and the quality of the costume is still rising.

The countermeasures

  • Codeword or callback verification for any unusual request, no matter how real the voice sounds
  • Public footprint reduction: less public audio and video means less raw material for cloning
  • Account hardening so a credential breach cannot feed the context attackers need
  • A standing impersonation watch that catches cloned material before it is used against you
FIELD NOTE If you receive an urgent call that sounds like someone you know asking for something unusual, hang up and call them back on a number you have used before. The clone cannot hold that conversation.