AI security · People

Deepfake fraud drills.

A cloned voice of your CEO calls finance: urgent, confidential, pay today. Would the money leave? With written consent we run realistic drills, fix the approval steps that failed, and train your team to pause and verify.

Get a fixed-price quote
Consent from every voice we useFinance and leadership drillsPayment approval fixes
drill · sample● demo
  1. FOUND Cloned CFO voice got a callback number changed
  2. BLOCKED Payment held: second approver called back
  3. FLAGGED WhatsApp voice note from “MD” forwarded
  4. FIXED Code word added for urgent payments
  5. PASSED Video call request verified in person
In plain words

A deepfake fraud drill is a safe, agreed simulation of a payment scam that uses AI-cloned voices or video of your own leaders. We test whether your payment approvals, callbacks and people stop an urgent fake request, then fix the process gaps and train staff with the recordings. Every cloned voice is used only with written consent and deleted afterwards.

Duration
1–2 weeks
Format
Drills plus live training
Consent
Written, from every voice used
Pricing
Fixed fee
How the scam works

How a deepfake payment scam unfolds.

  1. AttackerAttackers collect public audio

    Earnings calls, podcasts, conference talks and social videos of your CEO or CFO.

  2. AttackerThey clone the voice and pick a moment

    The leader is travelling or in meetings. The request lands late on a Friday.

  3. Your teamFinance gets a call, a voice note or a video meeting

    “We are closing a confidential acquisition. Transfer the deposit today, and do not discuss this with anyone.”

  4. Your dataUrgency beats process

    The approval rules allow an exception for the CEO. The callback goes to a number the caller supplied.

  5. The fixThe fix

    Callbacks only to numbers on file, a second approver for urgent payments, a code word for leaders, and staff who know they will never be punished for pausing to check.

A real case

In 2024 an employee of engineering firm Arup in Hong Kong transferred about HK$200 million (roughly US$25 million) after a video call in which the company’s CFO and colleagues were all deepfakes (Dezeen).

CERT-In’s May 2026 AI security blueprint asks organisations to set up verification steps for senior communications and to watch for executive impersonation, exactly the gaps these drills test.

What we test

The controls between a fake voice and your money.

  • Callback rules

    Do staff call back on a known number, or on the one the caller gives?

  • Payment approvals

    Can urgency or seniority skip the second approver?

  • Vendor bank changes

    Are changed bank details verified through a separate channel?

  • Messaging apps

    WhatsApp voice notes and texts that appear to come from leaders.

  • Video calls

    Whether a familiar face on screen is treated as proof of identity.

  • Reporting

    Whether staff report the attempt, and how quickly.

How it works

Consent first, then realistic drills.

  1. Week 1

    Scope and consent

    Agree targets, scenarios and limits, and get written consent from every leader whose voice or image we use.

  2. Week 1

    Drill design

    Realistic scripts built on your real payment flows, vendors and approval rules.

  3. Weeks 1–2

    Drills

    Calls, voice notes and, if agreed, video calls to selected staff. No real money moves.

  4. Week 2

    Debrief

    What worked, what failed and why, without naming and shaming individuals.

  5. Week 2

    Training

    A live session using the drill recordings, plus a one-page verification checklist.

What you get

Stronger approvals, sharper instincts.

HANULSECDeepfake fraud drill report CLIENTSample · manufacturer, finance team SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High2Medium3Low2 SCENARIOS · VOICE · VIDEO · MESSAGING TRAINING DONE Sample layout, not client data
  • 01
    Drill results

    What each scenario tried and how far it got, without blaming individuals.

  • 02
    Payment safeguards

    Changes to callbacks, approvals and vendor-change checks.

  • 03
    Code word protocol

    A simple verification step for urgent requests from leaders.

  • 04
    Live training session

    Staff hear the actual cloned voices, with consent, and practise the checks.

  • 05
    Verification checklist

    A one-page guide for finance, HR and executive assistants.

Who it is for

For the people who move the money.

  • Finance, treasury and accounts payable teams
  • Executive assistants and leadership offices
  • Companies whose leaders speak often in public or on video
  • Firms that pay vendors or move money across borders
  • Boards that want proof the approval controls really work

Ethics first

We only clone the voice or face of people who have agreed in writing. We never contact your customers, families or the public. Recordings and voice models are deleted at the end of the engagement, and results are shared without blaming individuals.

Questions

Questions buyers ask before they call us.

Q01What is a deepfake fraud drill?
A planned, consented test in which we imitate one of your leaders with an AI-cloned voice or video and make a realistic urgent request, such as a payment or a change of bank details, to see whether your people and approval steps stop it.
Q02Is it legal and ethical?
Yes, when done with consent. Every leader whose voice or image we use agrees in writing first, the drill stays inside your company, and recordings and voice models are deleted afterwards.
Q03Will staff be punished if they fall for it?
They should not be, and we recommend against it. The drill tests the process, not the person. People who are punished for being fooled stop reporting attempts, which is the opposite of what you want.
Q04How realistic are the cloned voices?
Realistic enough to matter. Modern tools can produce a convincing voice from a short sample of public audio. Hearing how good the fakes are is often the most memorable part of the training.
Q05Do you test video deepfakes too?
Yes, if you agree. Video drills need more consent and preparation, so most clients start with voice calls and messaging scenarios.
Q06How long does it take?
One to two weeks, including design, drills, debrief and training.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings