Deepfake phishing simulation
Deepfake Phishing Simulation
A deepfake phishing simulation puts an employee on a call with a cloned voice or a face-swapped video of someone they trust, with their consent, to see whether they verify an urgent request before acting on it. Callstrike runs both, on the channels your employees already use.
$25M
Lost in 2024 by one company in Hong Kong after a video call with deepfakes of its executives
3 sec
Of clean speech is enough to clone a voice for a simulation
9
Video channels a simulation can run on, plus the phone
What is a deepfake phishing simulation?
A deepfake is a voice or a face generated by AI to look and sound like a real person. A deepfake phishing simulation uses one in a controlled exercise: the employee gets a call from what looks or sounds like their CFO, their manager or the help desk, and is asked for something that should go through a check first. A payment. A password reset. Access to a system.
Email phishing tests teach employees to distrust a link. A deepfake simulation tests something harder: whether they trust a face and a voice they recognise.
How a deepfake phishing simulation works
Step 1
Consent
Employees agree to take part in the programme before any call is placed.
Step 2
The persona
Your security team chooses who the caller appears to be and why they are calling: an executive approving a payment, IT resetting an account, a supplier changing bank details.
Step 3
The call
A voice simulation is a live AI caller with a cloned or stock voice that rings from a local number, listens and answers. A video simulation is a person on your team who joins a real meeting wearing a live face and voice swap. If the employee asks the caller to stop, the call stops.
Step 4
The lesson
The call can end with in-call education, a follow-up email, or both, so the employee learns what gave it away. Results show who complied, who refused and who reported it.
Deepfake attack simulation platforms: voice and video in one
Most attacks that use a deepfake arrive on a phone call or a video meeting. Callstrike simulates both from one platform:
Voice calls with a cloned voice
A live AI caller holds the conversation, so the employee hears answers, not a recording.
Live deepfake video calls
A real person speaks through the swapped face and voice in real time, so the call reacts to every question the employee asks.
One set of results
Voice campaigns report by department; each video call records an outcome, a vulnerability level, an observation and the recording for the debrief.
What a deepfake call exercise actually looks like
Seven steps, start to finish, from the open-source material an attacker collects to the findings your team debriefs. Red teams run it to see whether anyone requested out-of-band verification before authorising a fake CFO. Security awareness and L&D teams run the same seven steps to demonstrate a live impersonation to leadership.
Harvest the face and voice
Your red team runs the same OSINT pass an attacker would. Callstrike needs three seconds of clean speech to impersonate the voice and one front-facing image to clone the face. A keynote, an earnings call or a LinkedIn photo carries both.
- Conference keynote
- Earnings call
- Podcast
- Bloomberg or CNBC interview
- YouTube
- WhatsApp voice note
- LinkedIn headshot
- Leadership page
- Press release photo
- Annual report
Configure the impersonation campaign
Capture who is being impersonated, their title and the exercise you are running. Callstrike keeps the details with the campaign, so the operator taking the call and whoever reviews the result later are working from the same record.
Choose the web meeting or chat app they trust
Select the delivery channel you will join as the impersonated identity, from Zoom, Teams, Google Meet, Webex, GoTo, Slack, Telegram, Signal or WhatsApp, so the exercise runs where your employees take their real calls.
- Zoom
- Microsoft Teams
- Google Meet
- Webex
- GoTo Meetings
- Slack
- Telegram
- Signal
Configure the face and voice swap
Callstrike runs your operator's camera through the swap and rates the quality before anything connects. This is the last point at which the likeness can be checked, so nobody goes live on one nobody has looked at.
Join the web meeting as the persona
With the face and voice swap configured, your operator joins the meeting as the impersonated identity, on Zoom, Google Meet or whichever platform the campaign is set to.
Deepfake the video meeting
The target sees your operator join as the impersonated identity and talks to them as that person for as long as the exercise runs. This is the meeting from the other side, the view every other participant has.
Capture the conclusions and report on them
Log the outcome of the exercise in Callstrike, rate how the target held up and record what your operator observed. The findings are what your debrief and your report are built from.
Nine video channels, plus the phone
Run the exercise where the real attack would happen.
- Phonea voice call from a local number
- Zoom
- Microsoft Teams
- Google Meet
- Slack
- Telegram
- Signal
- Webex
- GoTo Meeting
See every channel in the deepfake video call reference.
Deepfake phishing simulation for regulated industries
Banks, public bodies and law firms hold what a deepfake caller wants: one approved payment or one released file. In those organisations a simulation also has to hold up when someone asks how it was run. Callstrike records each employee's consent before any call, stops when asked, and lets your team close every call with in-call education, a follow-up email, or both.
Try a deepfake simulation free
See and hear what your employees would face. Three free tools.
AI Voice Cloning Test
Hear a vishing call in your own voice.
Voice Phishing Simulator
Hear your own voice turned into a boss, a colleague, or an unknown caller, live in the browser.Voice Phishing Accent Simulator
Hear the same scam script in a different accent, and see how much accent alone changes who your employees trust.Deepfake phishing vs vishing
Vishing is phishing by phone: a caller talks an employee into a payment, a password reset or a one-time code. Deepfake phishing adds a stolen identity, so the voice on the line, or the face on the screen, belongs to someone the employee already trusts. Attackers use it in three ways, and Callstrike simulates each one.
Deepfake video calls
Your CFO joins a Zoom, Teams or Google Meet call, with their face and voice swapped in live by an operator. The test this page is about.
See how a call runsAI vishing calls
An AI voice agent phones employees and holds the whole conversation by itself, so every employee can be tested, in many voices and accents.
Explore vishing simulationHuman-in-the-loop voice impersonation
An operator does the talking while AI turns their voice into an executive's in real time, for high-stakes calls that need a person to adapt.
Explore voice impersonationFrequently asked questions
Training in which employees take a consented call from a cloned voice or a face-swapped video of someone they trust, then learn what gave it away, so they verify the next real request.
It places the simulated call, holds the conversation in a cloned voice or a swapped face, and records how each employee responded, so your security team can see who needs more training.
They consent to the programme, not to the timing of each call, so the call is still a realistic test.
No. A person on your team joins the meeting wearing the face and voice swap and holds the conversation live. Voice calls are run by an AI caller and need no one on the line.
The call stops.
Zoom, Microsoft Teams, Google Meet, Slack, WhatsApp, Telegram, Signal, Webex and GoTo Meeting.
Explore Related
Vishing Simulation
Automated AI vishing at scale. Test hundreds of employees simultaneously.
ProductDeepfake Simulation Generator
Generate controlled deepfake simulations for security awareness training and red team exercises.
SolutionPenetration Testing
Test your organisation with deepfake-powered social engineering.
SolutionExecutive Protection
Protect C-suite executives from deepfake simulation assessments.
IndustryTechnology
How tech companies defend against conference hijacking.
ProductTry the Free Demo
Experience a live deepfake detection demo in your browser. No sign-up required.
Test the face and the voice your employees trust