Deepfakes are no longer a marginal threat. Voice fraud is reported by 41 percent of security leaders

On September 22, Gartner published a survey of 297 cybersecurity leaders conducted from March to May 2026. Forty-one percent of respondents said their organization had experienced at least one social-engineering incident involving synthetic voice during an employee call in the previous twelve months. In video calls, 36 percent of security leaders reported a similar incident. According to Gartner, AI increases the volume, personalization and credibility of fraud while weakening the traditional clues people used to recognize deception. An attacker can combine a fraudulent email, synthetic voice or image with publicly available information about an employee, their colleagues and a specific business situation. This does not mean traditional attacks have disappeared. Seventy-nine percent of the security leaders surveyed had seen at least one case of phishing, spear phishing or business-email compromise in the previous year. Voice or text-message fraud was reported by 58 percent of respondents. AI is therefore not creating an entirely new world of attacks; it is making familiar mechanisms significantly more convincing. Gartner’s Craig Porter notes that most attacks will continue to exploit users, stolen credentials, weak account-recovery processes and familiar technical methods. Defense therefore should not be based on the assumption that an employee can identify fraudulent communication from voice, image or writing style. Synthetic content will gradually undermine precisely that ability. Gartner recommends changing the security habit. For requests with significant impact, employees should not ask “is this fake?” but “have I verified this request securely?” Money transfers, changes to a supplier’s bank account, access recovery or the granting of privileged permissions should require independent verification regardless of how trustworthy the caller looks or sounds. Identity is the second area. Gartner recommends phishing-resistant authentication, risk-based access controls and trusted verification channels for critical workflows. Security systems should also monitor suspicious behavior even after a successful login or password reset. The third change is to connect incident data. Suspicious communications should be compared with account recoveries, new-device connections, permission changes and financial transactions. Individually, these events may look routine; together, they can reveal identity takeover. For business leaders, this is primarily a process issue. An organization can invest in synthetic-media detection, but the race between generators and detectors will continue. A more durable defense is to design critical operations so that a single voice, video call or message is never enough to authorize an irreversible decision. KEY TERMS Deepfake: Artificially created or altered voice, image or video that imitates a specific person. Social engineering: Manipulating a person in order to obtain access, information, money or another unauthorized advantage. Independent verification: Confirming a request through a different trusted channel from the one through which the original request arrived.

Deepfakes are no longer a marginal threat. Voice fraud is reported by 41 percent of security leaders

The full article is available to users registered at Hard Skills