Do you really know who's on the phone or in that video call? Thanks to the rise of AI deepfakes, the caller might not be who they claim to be.
That's according to a survey from Gartner, which found that four-in-ten (41%) of CISOs have reported social engineering attempts involving an employee phone call in the last year, with a further 36% seeing the same in a video call.
Notably, more than three-quarters (79%) of CISOs polled had seen at least one email phishing, spear phishing, or business email compromise (BEC) incidents in the last 12 months. A further 58% reported to have seen vishing, or fake voice calls, and smishing, a malicious text message, over the same time period.
Last year, the FBI warned about a text and voice campaign in which hackers claimed to be senior US officials. Such deepfake attacks can be elaborate, research shows. In one example from 2024, British engineering firm Arup lost $25 million following a video conference scam that included deepfake versions of the victim's co-workers.
In another case, deepfake voice notes impersonating an executive were used to encourage an employee to download malware, an example of multi-modal attacks that see attackers using voice and video alongside more traditional emails and texts.
The Gartner report comes as AI developers are ramping up efforts to prevent malicious actors from using their tools. Earlier this year, for example, Google warned that criminal groups are abusing Gemini to augment attacks, using large-language models (LLMs) to research and target victims.
AI deepfakes are making things easier
Such attacks have seen a rise in volume, personalization, and apparent credibility thanks to AI, according to Gartner, and it’s making detection increasingly difficult.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
"Attackers can combine phishing, business email compromise, synthetic media, and aggregated personal context across multiple channels,” said Craig Porter, Director Analyst at Gartner.
"Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods," Porter added. "CISOs must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats."
Back in 2024, an executive at Ferrari infamously prevented a deepfake voice attack by asking about a book recommendation from the person being impersonated.
What should companies do?
Gartner advised companies to move beyond "spot the fake" training toward making secure verification the "expected behaviour", regardless of where the request originates – be it email, voice, video, collaboration tools, and even AI applications.
Beyond that, companies should harden protections around "high value workflows" – such as account recovery, payment authori\ation, and identity controls – and increase efforts to detect identity abuse, including after a successful login or password resent.
Threat detection can be improved, Gartner added, by correlating suspicious communications with account recovery attempts, addition of new devices, and financial transactions.
Incident response should now include multimodal impersonation, the analyst firm added, as well as compromised agents that operate beyond where they should in systems and should consider AI recommendations being manipulated.