Deepfakes are hitting employee calls, and only 10% of companies are ready

Four in ten security chiefs now say a deepfake has already been on the line. A Gartner survey of 297 CISOs found that 41% experienced at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, and 36% saw the same on a video call. A week later, Pindrop's 2026 Deepfake Readiness Index added the uncomfortable follow-up: only 10% of organizations say they have purpose-built defenses in place. Attackers have found the softest part of the enterprise. It isn't the firewall. It's the live conversation.

The attack surface moved to the phone and the meeting room

Most identity controls were designed to verify a device, a password, or a token. Very few were designed to answer a simpler question: is the person speaking right now actually who they claim to be? That gap is what deepfake-enabled social engineering exploits.

The entry points are familiar and routine:

• IT help desk calls — an "employee" who has lost their phone asks for an MFA reset or a new passkey enrollment.
• Payment approvals — a "CFO" or "outside counsel" calls to confirm an urgent transfer.
• Remote job interviews — a face-swapped candidate passes video screening for a fully remote IT role.
• Video meetings — a familiar face in a grid of colleagues approves a request no one double-checks.

Gartner notes that some vishing campaigns now pose as internal IT support, call employees on personal mobile numbers outside corporate call controls, and even spoof the real help desk number on caller ID. Once the attacker controls account recovery, every downstream security control trusts them.

The cost of one convincing call

The Pindrop data shows these incidents are not minor nuisances. Among organizations that experienced or suspected a deepfake attack:

• Nearly half reported total costs of $500,000 or more, including direct losses, remediation, and staff time.
• About a quarter reported costs of at least $1 million.
• 49% reported follow-on cyberattacks, including ransomware.
• 37% of respondents said a single deepfake attack could put a company like theirs out of business.

That follow-on figure matters most. A cloned voice at the help desk is rarely the end goal. It is the first step toward credential theft, privileged access, and data exfiltration. The financial sector is seeing the same pattern at scale: the market for voice deepfake detection is growing quickly precisely because contact centers and executive approval chains are now prime targets.

Why "wait until it happens to us" is the default

Perhaps the most telling finding in Pindrop's index is behavioral. Three-quarters of respondents said deepfakes would only become a boardroom priority after a leader at their own organization was personally fooled or impersonated. Many still treat deepfakes as a reputational problem for celebrities and politicians, not an operational risk to payment workflows and account recovery.

At the same time, 74% of security leaders believe defenses will improve faster than attack quality. Optimism is not a control. Research cited by Help Net Security suggests that standalone detection is under constant pressure as generative models improve, which means the response has to be layered and built into workflows, not bolted on after a loss.

Closing the readiness gap: what security teams should do now

Gartner's guidance is clear that training employees to "spot the fake" is no longer enough. Verification must become the default for any request that carries risk. In practice, that means:

1. Harden the high-value workflows first. Account recovery, privileged access changes, and payment authorization are where attackers focus. Require phishing-resistant authentication and out-of-band verification through channels attackers cannot spoof.
2. Analyze the media, not just the metadata. Caller ID, meeting invites, and email headers can all be faked. Real-time analysis of the audio and video itself is needed to flag synthetic speech and manipulated faces while the conversation is still happening.
3. Verify identity across modalities. A cloned voice and a face-swapped video are often generated separately. Checking whether a voice is consistent with the face on screen adds a layer that single-channel attacks struggle to beat.
4. Connect the signals. Correlate impersonation reports and suspicious calls with account recovery events, new device enrollments, privilege changes, and outbound payments.
5. Update incident response playbooks. Include multimodal impersonation scenarios and run tabletop exercises with the help desk, finance, and HR teams who are most likely to take the call.

Don't wait for your own case study

The organizations that end up in the headlines are rarely careless. They are simply relying on controls built for a world where hearing a familiar voice or seeing a familiar face was proof enough. That world is gone.

If your help desk, finance team, or hiring managers make decisions on live calls, they need tools that can tell real people from synthetic ones in real time. Learn how Corsound AI Deepfake Detect analyzes voice and video during live interactions to stop impersonation before a reset, a hire, or a transfer goes through.