In early 2024, a finance employee in Arup’s Hong Kong office received an email from the UK office asking for a confidential transaction. He suspected fraud. Then he joined a video call where the chief financial officer and several colleagues looked and sounded exactly as they should.
He made 15 transfers totaling HK$200 million, about US$25 million, according to CNN. Every other person on that call was a deepfake.
The tools behind that attack are cheaper and easier to use now. AI social engineering gives attackers the voices, faces, and writing style of the people employees trust most. Most security programs still test their workforce against last decade’s phishing email and report training completion to the board. That gap is now a business risk, and closing it starts with understanding what changed.
What is AI social engineering?
AI social engineering is the use of artificial intelligence to research targets, write personalized messages, and clone voices and faces so attackers can manipulate people into handing over access, data, or money. The psychology hasn’t changed, but a convincing lie now costs almost nothing to produce.
Three things separate it from the social engineering security teams grew up with:
- Scale. A good spear-phishing email used to take hours of research. A model now drafts thousands, each tuned to its recipient.
- Personalization. Messages cite real projects, real vendors, and real managers, pulled from public profiles and press releases.
- Channel. Email is one front among several. Attacks arrive by phone, text, chat, and video, often in sequence, with each step making the next one more believable.
Attackers now sound like the people your staff trust
AI-written phishing built from your own org chart
In a 2024 study, a research team that included security technologist Bruce Schneier tested phishing on real people. Fully AI-automated phishing emails drew a 54% click-through rate, matching emails that human experts wrote and well above the 12% of a generic control group. The researchers estimated AI could make these campaigns up to 50 times more profitable at scale.
The raw material is public. LinkedIn shows who works in accounts payable. A press release names the new logistics vendor.
A model stitches those details into one email, for one clerk, from the vendor’s account manager, about an invoice due at month-end. Nothing in it looks like the examples in last year’s training module.
Phone calls turn the help desk into an entry point
In September 2023, the group Scattered Spider (Mandiant tracks it as UNC3944) got into MGM Resorts through a social engineering breach of the IT help desk. A later FBI and CISA advisory described how the group uses phone calls to convince help desk staff to reset passwords and MFA tokens. MGM told investors the incident would cost about $100 million in Adjusted Property EBITDAR, a measure of operating profit.
Help desks exist to fix problems fast and keep employees working. Many still treat a familiar-sounding voice plus a few personal details as proof of identity. Voice cloning now lets an attacker sound like the specific employee they claim to be, which removes the last thing an agent might have noticed.
Deepfake video calls now move money
Go back to Arup. Its employee did what most awareness programs teach: he doubted an unusual email. The video call settled it. Arup confirmed that “fake voices and images were used”, and its global CIO, Rob Greig, said the number and sophistication of attacks had been rising sharply.
For years, “get on a call and confirm” was the recommended control. Deepfakes broke it. Any process that ends with “they looked and sounded right” is now a process an attacker can complete.
Those three incidents share a pattern, and it explains why so many existing defenses stay quiet while they unfold.
Why traditional defenses miss AI social engineering
Most companies built their awareness programs for email. Attacks now arrive by voice, text, and video, and those channels perform better for attackers. Verizon’s 2026 Data Breach Investigations Report found that in phishing simulations, median click rates for mobile-centric lures like voice calls and text messages ran 40% higher than for email.
Simulations have the same blind spot. A generic package-delivery template looks nothing like a targeted message about your company’s actual vendor, sent to the one person who pays that vendor. Employees get good at spotting the template and stay unprepared for the message that matters.
Then there’s the metric. Completion rates and click rates prove training happened. They say little about whether the risk of a successful attack went down, which is the question leadership needs answered.
Boards are asking about AI attacks and few CISOs can answer
Most breaches involve a person. Verizon’s 2026 report found a human element in 62% of them, up from 60% the year before. Yet many risk registers still don’t put a number on human risk.
That’s getting harder to defend. Since 2023, SEC rules require public companies to describe the board’s oversight of cybersecurity risk in their annual report and to disclose material incidents within four business days of determining materiality. Directors who sign off on that disclosure want to know how exposed the company is to deepfake fraud and whether that exposure is shrinking.
A defensible answer has three parts:
- Exposure by team and role. Which groups (finance, IT support, executive assistants) attract the most attacks and comply most often.
- Trend over time. Whether that exposure is rising or falling quarter over quarter, measured on behavior.
- Controls on high-risk requests. What stands between a convincing voice and a wire transfer, password reset, or new MFA device.
Few security leaders can show all three today. The same technology driving these attacks makes the answer measurable.
Defenders catch up by using AI against AI
Start with the goal: a workforce that has practiced against the exact attacks it will face, and a single human risk number leadership can track every quarter. Getting there takes AI on the defensive side, because no team can hand-build personalized voice, video, and email simulations for thousands of employees.
Purpose-built platforms now take on that work. Frame Security, for example, is an AI-native Human Risk Security platform that runs AI social engineering simulations across email, voice, and deepfake video then scores each employee’s response into a calculated Human Risk Score rather than a click rate. Whatever tools a team chooses, the work looks like this.
Simulate the attacks your company will actually face
Simulations should look like real attacks on your company. That means AI-generated scenarios in every channel attackers use, built from your actual vendors and reporting lines. Difficulty should adjust to each employee’s history, so the controller who reports everything sees harder tests than the new hire.
When a new attack makes headlines, your employees should be able to practice against a version of it that same week.
Measure human risk with real behavior signals
Replace completion rates with a human risk score. Draw it from signals such as how often people report suspicious messages, the state of their MFA, visits to risky sites, and how they perform in simulations. Roll it up by team, role, and location.
The result is a number that moves when behavior changes. It shows where to focus and gives the board a trend line to watch.
Put process controls on every high-risk request
Even well-trained people slip, so the process has to catch what training misses. Require out-of-band verification (confirmation through a separate channel), a second approver, or a waiting period for password resets, MFA enrollment, and changes to payment or payout details. Mandiant’s hardening guidance for Scattered Spider recommends a callback to a registered number before any sensitive change and warns against verifying people with public data like birth dates.
Apply stricter rules to executives and administrators. Their voices are on earnings calls, podcasts, and conference stages, which makes them easy to clone. In May 2025, the FBI warned that attackers were sending AI-generated voice messages impersonating senior US officials.
What security leaders should do in the next 90 days
- Remove voice and face as proof. Rewrite help desk and finance verification scripts so recognizing someone never counts as authentication.
- Map your money and access channels. List every phone line, chat tool, and video platform that can trigger a password reset, an MFA change, or a payment.
- Run a realistic vishing and deepfake simulation. Build a voice phishing (vishing) scenario on a pretext an attacker could assemble from your public footprint, and start with finance and IT support.
- Add a second step to high-risk requests. Put a callback, second approver, or waiting period on resets, MFA enrollment, and payment changes.
- Define a human risk metric and baseline it. Pick behavior signals you can measure now and record where they stand today.
- Brief the board on exposure and trend. Show which teams carry the most risk, which way it’s moving, and which controls protect high-risk requests.
Attackers have already adopted AI. Defenders who use it to train and measure their people will have an answer when the board asks.
AI social engineering FAQ
Is AI social engineering more dangerous than phishing?
Yes, because it extends phishing into more convincing forms. AI removes the spelling errors and generic greetings people learned to spot, personalizes each message, and adds voice and video impersonation. The added risk comes from channels like phone and video, where most companies have never tested their employees.
Can security awareness training stop AI social engineering?
Not on its own. Programs built on annual videos and generic email templates prepare people for attacks they rarely see. Training cuts the risk when it uses realistic, personalized simulations across email, voice, and video and adjusts to each person’s risk. Pair it with process controls that make a single mistake hard to turn into a loss.
How can companies defend against deepfake voice attacks?
Take recognized voices out of identity checks. Require callbacks to a number from your own directory, a second approver, or a waiting period before any password reset, MFA change, or payment change. Give executives and administrators stricter rules, since their voices are public. Then run voice simulations so help desk and finance staff practice saying no to a convincing caller.
Can AI social engineering be detected automatically?
Partly. Email security tools catch many malicious messages, and deepfake detection is improving. But a live phone call or video meeting with a convincing clone often reaches the employee with no filter in between. That’s why detection needs backup from trained people and verification steps that hold up even when the attacker sounds right.
