A convincing email used to take effort to write. A convincing voice or video call used to take a studio. Generative AI has lowered the cost of both, which means the person on the other end of a request may not be who they appear to be. For federal teams, the answer is less about spotting fakes and more about building processes that do not depend on trusting a face, a voice, or a writing style.
How AI Changes Social Engineering
Social engineering has always targeted people rather than software. What AI changes is scale and polish. Public guidance from CISA, the NSA, and the FBI on synthetic media describes deepfakes as a growing concern for organizations, including impersonation of executives and attempts to authorize fraudulent transactions or gain access to networks.[1] The practical effect for defenders is that familiar warning signs, such as clumsy grammar or an unfamiliar sender style, are weaker signals than they used to be.
AI-generated phishing
Language models can draft fluent, well-targeted messages in seconds, in any tone, with correct agency terminology. They can also vary the wording across thousands of messages, which makes simple text-matching filters less effective. A message that references a real program name or a real reporting deadline looks routine, and routine is what gets clicked.
Voice cloning
Cloned voices can be built from short public recordings such as conference talks, podcasts, or recorded briefings. In May 2025 the FBI's Internet Crime Complaint Center (IC3) warned that malicious actors were using text messages and AI-generated voice messages that impersonated senior U.S. officials to target current and former government officials and their contacts.[2] The FBI's advice was to verify identity through an independent channel before responding or acting.
Video deepfakes
Synthetic video can place a familiar face on a live call or in a pre-recorded message. Quality varies, and many fakes are still imperfect, but a short, low-resolution video call is exactly the setting where imperfections are easy to miss. Treat a face on a screen as a claim, not as proof.
Executive Impersonation and Business Email Compromise
Business email compromise (BEC) is the use of impersonation or account takeover to trick someone into sending money or sensitive information. The FBI IC3 tracks BEC as a distinct crime category in its public reporting.[3] AI strengthens the classic pattern: a request that appears to come from a senior leader, marked urgent and confidential, asking a staff member to bypass the usual steps.
Federal teams and contractors face several versions of this:
- A "director" asking for an off-cycle change to payment or banking details on a vendor invoice.
- A "contracting officer" requesting that a deliverable or controlled information be sent to a new address.
- A "help desk" caller asking for a password reset, an MFA prompt approval, or a one-time code.
- A "colleague" on a video call asking for access to a shared system.
The common thread is pressure plus a request to skip a step. Defenses should therefore target the step, not the persona.
Reconnaissance From Public Information
Convincing impersonation needs material. Attackers collect it from professional networking profiles, agency directories, conference agendas, press releases, contract award announcements, and personal social media. Org charts, reporting lines, travel schedules, and the names of colleagues are all useful for tailoring a message. AI tools make it faster to summarize that material and turn it into a pretext.
You cannot remove everything that is public, and federal work often requires public visibility. Reasonable steps include reviewing what role-specific details are posted, tightening privacy settings on personal accounts, being cautious about posting travel plans in real time, and reminding staff that connection requests from unknown people can be reconnaissance.
Smart Devices and the Home Office
Voice assistants, cameras, and other connected devices in homes and offices can collect audio, video, and routine information about the people near them. Recordings and account data held by consumer services are potential source material for impersonation, and poorly secured devices can be an entry point to the network they sit on. For teams that work remotely, basic hygiene matters: change default credentials, keep device firmware updated, separate smart devices from work equipment on the network where possible, and review what each device records and where that data is stored. Keep sensitive conversations away from always-listening devices.
A Verification Flow for High-Risk Requests
The most reliable defense is a rule that does not care how real the request sounds. Any request involving money movement, credentials, access changes, or sensitive data triggers a verification step through a separate, known-good channel.
Defenses That Work
Out-of-band verification and dual approval
Call back on a number you already trust, not one supplied in the message. Agree on this procedure ahead of time so that staff have explicit permission to say "I will call you back," even to a senior leader. For payments, banking changes, and access grants, require a second approver so no single persuaded person can complete the action alone.
Phishing-resistant multi-factor authentication
Codes sent by text message or approved with a tap can be relayed to an attacker. CISA publishes guidance on phishing-resistant MFA, such as FIDO2/WebAuthn security keys and PKI-based authentication, which bind the login to the legitimate site.[4] OMB Memorandum M-22-09 directs federal agencies to require phishing-resistant MFA for their staff, contractors, and partners.[5] NIST SP 800-63B provides the underlying authenticator guidance.[6] A deepfake can talk someone into many things, but it cannot produce a hardware-bound credential.
Awareness training that matches the threat
Update training with realistic examples of cloned voices and synthetic video, and teach the process rather than a checklist of visual tells. Short scenario exercises, such as a simulated urgent request from a supervisor, build the habit of pausing. Include finance, contracts, HR, and help desk staff, since they are the usual targets.
A reporting culture
Make reporting quick and blame-free. A staff member who spots a suspicious call and says so protects everyone else who got the same call. Provide one easy channel, acknowledge reports, and share sanitized examples so people see that reports lead to action. Federal employees should follow their agency's incident reporting procedures.
Know the limits of detection
Deepfake detection tools can be a useful signal, but they are not a guarantee. Generation and detection methods keep changing, and a tool that misses a fake provides false comfort. CISA and partner agencies point to a layered approach that includes verification processes and, where available, content provenance and authentication measures, rather than relying on detection alone.[1] Treat detection as one input, never as the deciding control.
Procurement and process controls
Build resistance into business processes, not just security tools:
- Require verified, documented procedures for changing vendor banking details or remittance information.
- Define which requests can never be approved by chat, text, voice message, or a single email.
- Include impersonation and verification expectations in contractor and subcontractor onboarding.
- Keep a current, authoritative directory that staff can use for callbacks.
- Log high-risk approvals so they can be reviewed after the fact.
If Identity Theft Happens: A Response Plan
When an attacker succeeds in impersonating someone, or an employee's personal identity is stolen, speed and clear ownership matter. A workable plan covers both the organization and the individual.
For the organization
- Report immediately to the security team and, for federal systems, through the agency's incident reporting process.
- Contain: reset affected credentials, revoke sessions and tokens, and review recent account activity and mailbox rules.
- If funds were sent, contact the bank at once. For U.S. victims, file a complaint with the FBI IC3, which accepts reports of internet-enabled fraud.[3]
- Preserve evidence such as emails, call logs, recordings, and message headers.
- Review lessons learned and update verification procedures.
For the affected individual
- Report and get a recovery plan at the FTC's IdentityTheft.gov.[7]
- Place a fraud alert or credit freeze with the credit bureaus.
- Change passwords and enable phishing-resistant or app-based MFA on personal accounts, starting with email.
- Notify the employer's security office if work accounts or information may be involved.
Key Takeaways
- Voice, video, and writing style are no longer reliable proof of identity.
- Verify high-risk requests through a separate, trusted channel and require a second approver.
- Use phishing-resistant MFA for staff, contractors, and partners.
- Train on the process, not only on spotting fakes, and make reporting easy and blame-free.
- Treat deepfake detection as a helpful signal, not a control you can depend on.
- Have an identity-theft response plan before you need one.
How BE EASY Can Help
BE EASY ENTERPRISES LLC is a Service-Disabled Veteran-Owned Small Business that supports federal customers with cybersecurity and technology work. If your team wants to review verification procedures, plan awareness exercises, or discuss authentication approaches, we are glad to talk through your requirements. Contact us to start a conversation.
References
- NSA, FBI, and CISA, "Contextualizing Deepfake Threats to Organizations," Cybersecurity Information Sheet, September 2023. Available: https://media.defense.gov/2023/Sep/12/2003298925/-1/-1/0/CSI-DEEPFAKE-THREATS.PDF
- FBI Internet Crime Complaint Center (IC3), Public Service Announcement, "Senior U.S. Officials Impersonated in Malicious Messaging Campaign," May 2025. Available: https://www.ic3.gov/PSA/2025/PSA250515
- FBI Internet Crime Complaint Center (IC3), reporting portal and annual Internet Crime Report. Available: https://www.ic3.gov/
- CISA, "Implementing Phishing-Resistant MFA" fact sheet. Available: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
- Office of Management and Budget, Memorandum M-22-09, "Moving the U.S. Government Toward Zero Trust Cybersecurity Principles," January 26, 2022. Available: https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
- NIST, Special Publication 800-63B, "Digital Identity Guidelines: Authentication and Lifecycle Management." Available: https://pages.nist.gov/800-63-3/sp800-63b.html
- Federal Trade Commission, IdentityTheft.gov. Available: https://www.identitytheft.gov/
