Picture this, as a hypothetical: it is 9:15 on a Monday morning at a mid-sized Hong Kong company. The help desk receives a call from someone who sounds exactly like the group financial controller, asking for a password reset because she is locked out ahead of a board meeting. The caller ID looks plausible — a familiar prefix, a mobile number nobody has stored. The voice has the right cadence, the right impatient tone. The employee complies, and by lunchtime an attacker holds a valid credential inside the finance function.
The scenario is invented, but the mechanics are not — and that is why a growing number of security managers are turning to structured deepfake readiness drills: controlled simulations that reveal, while nothing is at stake, exactly where an organisation's verification procedures break down. According to The Hacker News, which set out the approach in a report published in mid-October, the drill format lets teams locate those failure points before an attacker does.
The threat has moved past detection
Cloned voices and synthetic video now appear routinely in payment-diversion fraud, help-desk resets, and fabricated executive video calls. What distinguishes this wave from conventional phishing is that the usual technical defences — links, attachments, mail gateways — have nothing to catch. The channel is a human conversation, and it has been weaponised against human trust.
Hong Kong knows this better than most. In a case attributed to the city's police, fraudsters used deepfaked video to impersonate a company's chief financial officer in a live meeting, convincing staff at engineering firm Arup to transfer roughly HK$200 million (about US$25 million). No malware, no exploit — just a synthetic face and a credible voice.
Faced with that, the honest answer for security leaders is uncomfortable: your team probably cannot reliably tell a cloned voice from a real one by ear. Detection-by-ear is not a dependable skill, and training programmes that pretend otherwise are building on sand. The pass criterion for a drill should therefore not be "did you spot the fake?" It should be: "did you verify through a channel the attacker could not control?"
Running your first drill
The following six-step checklist is designed for IT and security managers preparing their first exercise.
-
Select one high-value scenario. Choose a single, realistic target — a payment instruction, a credential reset, an access request — rather than testing everything at once. One scenario, instrumented properly, teaches more than five run loosely.
-
Define out-of-band verification as the pass criterion. Write down, before the drill, exactly what correct behaviour looks like: a callback to a pre-registered number, a confirmation through a second approver, a documented challenge phrase. The drill passes when the employee verifies — not when they detect.
-
Enlist a willing executive. A drill succeeds only with buy-in. An executive who consents to be "impersonated" becomes an ally in the debrief; one who discovers it afterwards becomes an obstacle.
-
Instrument the touchpoints. Log every step an attacker would have used: the call time, the help-desk response, the ticket number, the approval chain. You are mapping the procedure, not testing individuals.
-
Debrief without blame. The findings should be presented as properties of the situation, not personal failings.
-
Repeat and vary the vector. One drill is only a snapshot. Move from voice to video to chat-based impersonation over successive exercises.
Where verification usually breaks
The analytical value of the drill lies in diagnosing why staff comply. Four patterns recur: an authority gradient that makes a request from a senior figure effectively unrefusable; manufactured urgency that compresses the time available to think; a plausible-but-unfamiliar caller ID that satisfies the check employees think they are performing; and simple reluctance to appear insubordinate to a boss who may or may not be real. Naming these patterns gives managers the vocabulary to justify procedural and budget changes to their boards.
Hardening afterward
Findings should convert into concrete controls: mandatory callbacks to known numbers, dual authorisation for payments, out-of-band verification of any executive-originated request, and scripted help-desk responses for reset calls. Deepfake detection tools can add a layer, but error rates are real, and they are a supplement to procedure, never a replacement for it.
Finally, clear any drill with HR and legal beforehand, ensure synthetic-media exercises comply with consent and biometric-data requirements, and rotate through varied scenarios to avoid drill fatigue. The cloned call is coming; the question is whether your team verifies first and apologises later — or the reverse.
試想一個假設情景：星期一早上九時十五分，香港一間中型公司的服務台接到一個電話，來電者的聲音與集團財務總監一模一樣，聲稱因董事會會議在即而被鎖定帳戶，要求重設密碼。來電顯示看似合理——熟悉的前綴，加上一個沒有人儲存過的手機號碼。聲線的節奏恰到好處，不耐煩的語氣也十分逼真。員工照辦，到了午飯時間，攻擊者已取得財務部門一個有效的登入憑證。
這個情景雖然是虛構的，但其運作手法並非如此——正因如此，越來越多保安主管正轉向結構化的 deepfake 演練：在毫無實際風險的情況下，透過受控的模擬情境，準確揭示組織的核實程序在哪些環節失效。根據 The Hacker News 於十月中旬發表的一篇報道，這種演練形式讓團隊得以在攻擊者出手之前，先找出這些失效點。
威脅已超越「偵測」的層面
仿冒聲音和合成影片現已常見於款項轉移詐騙、服務台密碼重設，以及虛構的高層視像會議之中。這一波攻擊與傳統釣魚電郵的不同之處在於，慣常的技術防禦手段——連結、附件、郵件閘道——完全無法攔截。攻擊渠道是一場人與人之間的對話，而它已被武器化，用來攻擊人類的信任。
香港對此的體會比大部分地方更深。在一宗由香港警方偵破的案件中，詐騙集團利用 deepfake 影片，在一場實時會議中冒充一間公司的首席財務官，成功說服工程公司 Arup 的職員轉帳約二億港元（約二千五百萬美元）。沒有惡意軟件，沒有漏洞利用——只有一張合成的面孔和一把可信的聲音。
面對這一切，保安主管最誠實的答案令人不安：你的團隊很可能無法單靠耳朵可靠地分辨仿冒聲音和真實聲音。靠聽覺偵測並不是一項可靠的技能，任何假裝並非如此的培訓計劃都是在沙上建屋。因此，演練的合格標準不應是「你有沒有察覺到是假的？」而應是：「你有沒有透過一個攻擊者無法控制的渠道進行核實？」
開展首次演練
以下六步清單專為首次籌備這類演練的 IT 及保安主管而設。
-
選取一個高價值情景。 選擇單一而真實的目標——一道付款指示、一次憑證重設、一個存取請求——而非同時測試所有項目。一個經過妥善設計的情景，比五個草草進行的情景更有成效。
-
將 out-of-band verification（帶外核實）定義為合格標準。 在演練開始前，清楚寫下正確的行為應是怎樣：回撥一個預先登記的號碼、透過第二位批准者確認、或使用一組已記錄的 Challenge Phrase。演練合格的標準是員工進行了核實——而非他們察覺了偽冒。
-
爭取一位願意配合的高層參與。 演練只有在獲得支持的情況下才會成功。事先同意「被冒充」的高層會成為事後檢討中的盟友；事後才發現真相的高層則會成為阻礙。
-
為各接觸點加設記錄。 記錄攻擊者本來會使用的每一個步驟：來電時間、服務台的回應、工單編號、審批鏈。你要繪製的是流程圖，而非考核個別員工。
-
檢討時不作指責。 相關發現應以情境本身的特質來呈現，而非個人的過失。
-
重複演練並轉換攻擊渠道。 一次演練只是一個快照。在多次演練中，逐步由語音轉到影片，再到基於聊天工具的仿冒。
核實通常在哪裡失效
演練的分析價值在於診斷員工為何會照辦。以下四種模式反覆出現：權威梯度，令來自高層的要求變得實際上難以拒絕；人為製造的緊迫感，壓縮了員工思考的時間；看似合理卻陌生的來電顯示，足以滿足員工以為自己正在進行的檢查；以及單純不願顯得抗命——不願對一個可能真、也可能假的上司說不。明確點出這些模式，能賦予管理層一套用詞，向董事會說明為何需要改變流程及增撥預算。
事後加固
發現應轉化為具體的控制措施：強制回撥已知號碼、付款雙重授權、對任何來自高層的要求進行帶外核實，以及為密碼重設來電準備預設的服務台應答腳本。Deepfake 偵測工具可以增加一個防護層，但錯誤率是真實存在的，它們只是程序的補充，絕不能取代程序。
最後，事前須取得人力資源部及法律部門的批准，確保合成媒體演練符合同意書及生物特徵數據的相關規定，並適度轉換不同情景，以避免演練疲勞。仿冒電話終究會來臨；問題在於你的團隊會先核實、後道歉，還是倒過來。