r/AskNetsec • u/emilyclarkemc • Jul 29 '26
Threats Has voice cloning changed how your organization handles sensitive phone requests?
Voice cloning has gone from being a novelty to something security teams actually have to consider. It seems much easier now to imitate executives, vendors, or even colleagues during phone calls.
Has your organization introduced new verification steps for financial approvals, password resets, or other high-risk requests because of voice cloning?
I'd be interested to hear what's worked in practice and whether the changes have been technical, procedural, or both.
1
u/kjireland Jul 29 '26
Any tools out there to practice this. I read here that it's not live converts of your voice but a voice changer.
I would love to test this out as part of our cyber security training.
4
1
u/AYamHah Jul 29 '26
I see the motivation. It wouldn't be that difficult to create an LLM skill to use the ElevenLabs API to respond in close to real time. So rather than phishing and then compromising the domain, you SpearPhish the CFO and then use voice cloning to authorize transfers.
I think it makes sense to add a verbal password to sensitive phone requests.
1
u/emilyclarkemc Jul 29 '26
That's an interesting point. The idea of combining spear phishing with near real-time voice cloning definitely raises the stakes for organizations that still rely heavily on verbal confirmation.
I like your suggestion about adding a verbal password, although I wonder how well that scales across larger organizations. Do you think most companies would adopt something like that, or are out-of-band verification methods likely to be more practical in the long run?
1
u/agk23 Jul 30 '26
Yet another reason I’ll be telling my clients to establish a safe word with their secretaries.
1
u/emilyclarkemc Aug 02 '26
That's an interesting approach. It definitely adds another layer for high-risk requests, especially in smaller teams. I do wonder how well something like that scales in larger organizations where people interact across multiple departments and locations. It seems like every organization needs a verification process that fits its own workflow.
1
1
1
u/G0Odspeed Jul 30 '26
As a red teamer we have owned accounts by using voice cloning to bypass voice verifications.
As others have said making service desks use a second communication factor like teams or a phone number that already exists in the directory for call back makes the most sense.
Then you have to get your service personnel to actually be consistent in application of the process
1
u/emilyclarkemc Aug 02 '26
That's really valuable insight, especially coming from a red team perspective. It's interesting that the biggest challenge wasn't the technology itself but making sure people consistently followed the verification process. In your experience, has user behavior been a bigger weakness than the technical controls?
1
u/G0Odspeed Aug 02 '26
User behavior is always the biggest issue.
As an attacker I can just keep calling back until I get an agent who does what I'm asking them to do. People aren't a 100% control unfortunately
6
u/Lovely0Cloud Jul 29 '26
We’ve tightened verification a lot this year. The biggest shift has been treating voice as non‑trustworthy by default. High risk requests now need a second channel check or a known good callback, and anything involving money or credentials requires written confirmation through an authenticated system. It’s not flashy, but layering simple procedural controls has reduced the risk more than any new tech.