AI can fake a familiar face or voice on a live call. We test your payment, help desk and hiring steps against it. Then we help you add checks an impostor can't pass.
“We need the new supplier paid today. I'll explain later.”
Payment request
- Amount
- £148,000
- To
- New supplier, added today
- Asked on
- This video call
How a good check works
Four steps an impostor can't fake.
Follow one urgent request through a payment process built for it.
Incoming video call
Finance director
Please pay the new supplier today. It's urgent.
£148,000 · new payeePayment request · example
£148,000 to a new supplier
- Asked for on a video call
- Callback to the number on file
- Director: not confirmed
- Held and logged
Where impersonation hits.
Each ends in an action that's hard to undo. Each has a simple check that stops it.
Payments
- What they ask for
- An urgent transfer to a new account.
- The check that stops it
- Call back on a number you already hold.
Help desk
- What they ask for
- A password or login reset for a locked-out executive.
- The check that stops it
- Verify through a channel set up before the call.
Supplier changes
- What they ask for
- New bank details for a supplier you pay every month.
- The check that stops it
- Confirm with a known contact before the change goes live.
Remote hiring
- What they ask for
- A candidate who isn't who they claim to be.
- The check that stops it
- Check identity documents before granting any access.
Our view
Don't rely on spotting the fake. Rely on a step it can't pass.
Detection tools help, but none catches everything. A callback to a known number works whether the fake is good or not.
How we run an impersonation test.
Agree the rules first.
We agree in writing who knows about the test, who we may imitate and where we stop.
We never move real money, and we never lock anyone out of a real account.
Pick the workflow that matters most.
Usually that's payments, help desk resets or supplier bank changes. Choose the one where a single convincing request could cost you most.
Run a realistic request.
We use the channels an attacker would: a phone call, a voice note, an email thread or a video meeting.
If we imitate a real person's voice, we do it only with that person's consent.
Fix the process, then rehearse it.
We help you add simple checks: callbacks to known numbers, a second approver and limits on new payees.
Then we practise them with the people who use them, so they hold under pressure.
What we won't promise.
No one can spot every fake. We focus on a process that still holds when the fake is perfect.
Test the request before someone fakes it.
Pick the workflow where one convincing call could cost the most. We'll test it and help you add the checks.