Free tools. No technical expertise. A preparation phase that begins weeks before the call. The attacker's edge is not sophistication — it is that the verification controls they face were never designed for this threat.
Attackers map the organisation from LinkedIn, SEC filings, and press releases — identifying who approves wire transfers, which vendors are active, and what a financially plausible pretext looks like right now.
Audio harvested from earnings calls, keynotes, and podcast appearances. A convincing clone assembled using free tools requiring no specialist skill — complete with speech patterns and verbal mannerisms.
Target employee receives a call — or video call — from what sounds and looks exactly like their CEO or CFO. Urgency created. Confidentiality requested. The psychological mechanism is authority compliance, not ignorance.
Payment executed before standard verification can intervene. In multimodal campaigns, email, voice, and video are layered sequentially — each channel reinforcing the last until no verification instinct remains to slow the process.
"Deepfake fraud is not defeated by teaching employees to listen more carefully. It is defeated by building verification processes that a perfect imitation still cannot pass."
Executive targeting campaigns detected before the first call is placed. Payment verification that no voice clone can bypass.