How do you train staff to spot deepfake impersonation and payment fraud?
Quick answer, Nov 5, 2026As of 5 November 2026, train for the three ways synthetic media reaches a company — impersonation targeting the brand, impersonation for financial gain, impersonation to gain access — then drill one out-of-band verification step no caller can talk a person out of. NSA, FBI and CISA tell every organisation to put deepfake techniques into its training programme.
What the training has to cover
| What staff meet | What the training makes them do | Source (section) |
|---|---|---|
| A senior executive urging a transfer: manipulated audio, video or text used to "illegitimately authorize the disbursement of funds" | Stop, and verify on a number the company holds | NSA, FBI and CISA, Contextualizing Deepfake Threats to Organizations, "How deepfakes can impact organizations" — Impersonation for financial gain |
| A channel pivot: a poor call on a messaging app, a move to video, a move to text, then the wire request | Treat the pivot itself as the signal, not the audio quality | Same sheet, "How deepfakes can impact organizations" — the two May 2023 examples |
| A remote interview that does not line up | Escalate rather than accommodate | Same sheet — Impersonation to gain access |
| A permission screen after a link from an unfamiliar account, granting an application the ability to read and send mail as the user | Never approve an application you did not go looking for | FBI IC3 alert I-090126-PSA, 1 September 2026, "How OAuth Consent Phishing Works" |
| A cloned voice of a relative or other personal contact, a crisis, an immediate money ask | Use the agreed word or phrase; call back on a number you looked up | FBI IC3 alert I-120324-PSA, 3 December 2024, "AI-Generated Audio, aka Vocal Cloning"; "Tips to protect yourself" |
| Onboarding documents that disagree, a declined multifactor prompt, a third-party webcam plugin during a live check | Flag for re-review and open the filing question | FinCEN alert FIN-2024-Alert004, 13 November 2024, "Financial Red Flag Indicators of Deepfake Media Abuse" |
The verification step is the lesson
Detection by eye is the weak link, and the guidance says so by what it recommends. NSA, FBI and CISA put real-time verification first: identity verification that tests for liveness, and mandatory multifactor authentication using a one-time password or PIN, known personal details or biometrics — "especially important when considering procedures for the execution of financial transactions" ("Recommendations for resisting deepfakes," section 1, "Real-time verification capabilities and procedures").
FinCEN adds the tell worth teaching: criminals using a synthetic identity try to avoid live verification, claiming repeated technical glitches or asking to change communication method mid-check ("Detecting and Mitigating Deepfake Identity Documents"). The pressure to skip the step is itself one of the flags.
One caveat belongs in the same session. Consent phishing bypasses both password and multifactor authentication, because the user grants access rather than surrendering a credential: it "can only be revoked by the victim invalidating the token in their application security settings; not by changing the password" (I-090126-PSA, "How OAuth Consent Phishing Works"). Staff trained to reset a password will do the wrong thing here.
Who gets trained, and in what
NIST sorts audiences into three segments: all users, privileged access account holders, and staff with significant cybersecurity or privacy responsibilities, who need role-based training (SP 800-50r1, September 2024, section 2.5, "Learning Program Audience Segments"). The people a payment-fraud caller actually reaches — accounts payable, treasury, executive assistants, onboarding and KYC staff — sit in the first segment by default. Naming them as a role-based audience is what makes the programme work.
On method, section 2.7.2, "Experiential Learning," is explicit: practical exercises include simulated phishing, smishing and vishing, and tabletop exercises; establish current click rates before targeting training; involve the legal team in exercise design; tell employees that exercises run at random; keep them non-punitive.
Drill it, then write it down
Once a plan exists, "do several tabletop exercises to practice and analyze the execution of the plan," involving the likely targets ("Recommendations for resisting deepfakes," section 2, "Plan and rehearse"). The same section, under "Training personnel," says every organisation should put an overview of deepfake techniques into its training programme.
Run it to a standard. NIST SP 800-84 section 4, "Tabletop Exercises," defines one as a discussion-based event: people with a role in the plan meet to discuss their roles and their responses, with a facilitator guiding the discussion to pre-defined objectives. Section 4.4, "Conduct the Tabletop Exercise," has the facilitator walk participants through the scenario and open with a question "designed to prompt decision-making or coordination among participants." Section 4.5, "Evaluate the Tabletop Exercise," puts the debrief and lessons learned into an after action report with recommendations, which then drive action items and a plan update; Appendix A.3 is a sample.
For the scenario and the paperwork, CISA Tabletop Exercise Packages are the shortcut: over 100 customisable packages with template objectives, scenarios and questions ("Description"), plus facilitator and participant templates and an after action report ("CTEP Documents").
If you are a financial institution
Training for onboarding and KYC staff ends in a filing decision. FinCEN asks institutions to reference FIN-2024-Alert004 by putting the key term "FIN-2024-DEEPFAKEFRAUD" in SAR field 2, "Filing Institution Note to FinCEN," and in the narrative ("Suspicious Activity Report (SAR) Filing Request"), so both belong in one module.
Distributed Risk arranges training with a partner firm that runs it in your region, with the investigative work when a recording is disputed: send the question.
Questions
Does awareness training stop a deepfake call? On its own, no. The guidance puts the weight on the verification step, and training's job is to make that step non-negotiable and an instruction to skip it a warning sign.
Who should be in the first tabletop exercise? The people the scenario names: the payment approver, their executive, and security. NSA, FBI and CISA recommend exercises involve "the most likely targets of deepfakes and include executives who may be prime targets" ("Plan and rehearse").
What do we report, and to whom? Report malicious deepfakes to the FBI, through a local field office or CyWatch ("Reporting and sharing experiences"). IC3 asks those hit by consent phishing to contact their relevant security officials, report the incident to a local FBI field office or IC3, and keep screenshots of the messages (I-090126-PSA, "Report It").
Is this legal advice? No. This page is a procedural summary drawn from the public record. Counsel decides what applies.