Validating Identity in a World of Deepfakes

The talk starts from a 2023 incident in which attackers reportedly used a deepfaked voice of an IT staffer to persuade an employee on a phone call, after a fake login portal had already captured credentials. It also points to a reported case in which live video-call impersonation was used to move a large sum of money at a financial firm in Hong Kong. The central question is how an organization can confirm that a person is who they claim to be when voices, faces, IDs, phone numbers and email accounts can all be spoofed.

The speaker builds a simple threat model focused on impersonating existing employees. It covers how attackers collect voice and image samples, how generative tools make lookalike sites and writing-style mimicry easier, and how existing processes such as password resets or conditional access can be bypassed. Rather than trying to block public content, the talk argues for layered validation across employee guidance and internal processes. It then walks through eleven methods, including in-person checks, video calls paired with ID review, device and IP matching against logs, calls to emergency contacts, personal email requests, PGP-signed messages, certificate-based device MFA and hardware keys. Each method is weighed for reliability, cost and effort, and placed on a maturity chart against the impact of an impersonation.

Two worked scenarios show how the methods combine: a suspicious call with a head of HR, and a late-night password reset request from a devops engineer where log review and a follow-up chat exposed an unmanaged device. The takeaways are that no single control is sufficient, that stacking layers raises the cost for attackers, that a culture where staff can pause and question requests matters, and that high-value transfers should need more than one approver. The speaker closes by calling for ongoing community discussion as these practices mature.