Not every voice on the call is real. Not every face is either.

Cloned voices and deepfake faces now hit the wires, hires, and approvals that SMB and mid-market teams run on every day.

See a real attack arc Read the research

30 minutes · NDA-safe

The last 18 months

442%

rise in vishing attacks

700%

rise in deepfake video scams

1 in 4

job candidates projected synthetic by 2028

83%

of SMBs say AI raised their threat level

Sources: CrowdStrike, Deloitte, Gartner, US Chamber of Commerce.

Threat categories

Where the losses are landing.

Six fraud patterns where AI social engineering is already converting into measurable loss for SMB and mid-market teams.

Real estate wire fraud

Hundreds of millions redirected per quarter on closing wires.

Bank and treasury wire fraud

Single incidents have cleared $35M on a cloned voice call.

Vendor and invoice redirect

The most common BEC pattern, now arriving with synthetic audio.

Synthetic candidate hiring fraud

Up 220% year over year, including state-sponsored operators.

Insurance claim fraud (synthetic FNOL)

Cloned claimants and fabricated callers entering payout paths.

Executive impersonation overrides

Deepfake video calls used to push exceptions past normal review.

The Manipulation Arc

The playbook attackers actually run.

Every AI-assisted social engineering attack moves through the same stages. Diopter watches the attack progress and reaches a verdict before the ask lands.

T-7d → T-1h

Authority

The attacker establishes a believable role: a cloned exec, a title agent, a hiring manager, or a known vendor.

T-00:00

Urgency

Time pressure compresses normal verification. The deal closes today. Payroll runs in an hour.

T+02:00

Isolation

The channel narrows and witnesses are removed. Move to DM, private call, or off-domain email.

T+06:00

Escalation

Stakes rise. Threats, secrecy clauses, or 'just between us' framing accelerate compliance.

T+11:48

Ask

The wire approval, MFA reset, credential, hire decision, or vendor change finally lands.

What Diopter does

Catch the arc before the ask lands.

Diopter evaluates voice, video, and conversation signals across the call, scores the arc as it progresses, and reaches a verdict your team or workflow can act on, before the wire, the hire, or the approval goes through.

01Step

Watch

Voice, face, and conversation signal on every call, across Teams, Zoom, Meet, Webex, and your VoIP trunk.

02Step

Score

The Manipulation Arc is scored live. Authority, urgency, isolation, escalation, and ask each move the number.

03Step

Decide

A verdict and a recommended action: clear, hold for review, or block. Routed to the team or workflow that owns the next step.

See the full verdict matrix below, or read how this compares to existing defenses.

Verdict matrix

How Diopter decides.

The detail behind the verdict above: media reality crossed with conversation pressure produces a recommended action your team or workflow can act on.

Verdict matrix · ai detection × arc4 verdict classes

Axis 01 · AI Detection

Are the voice and video frames synthetic, or a real human?

Axis 02 · Conversation Arc

Is the dialogue being shaped toward authority, urgency, isolation, and an irreversible ask?

AI Detection	Arc Risk	What this looks like on a call	Verdict	Recommended action
Clean	Low	Real human on the line, request flow looks normal. No synthetic media, no pressure pattern.	Verified	Allow
Clean	High	Real human voice, but the conversation is being shaped toward an irreversible ask through urgency, authority framing, and off-policy timing. A social-engineering attempt by a real person, or a coached insider.	Potential Threat	Flag for review
Synthetic	Low	Synthetic voice or deepfake video detected, but the conversation isn't pushing toward a high-risk action. Often a benign AI agent, voice filter, or early-stage probe.	Suspected Threat	Hold for verification
Synthetic	High	Synthetic media plus the arc is closing on a wire, MFA reset, credential hand-off, or hire. Both axes confirm.	High-Risk Threat	Block

Why Diopter

What the arc adds.

Most of this category is built and priced for the Fortune 500. Here is how Diopter compares to the defenses an SMB, a mid-market IT team, or an MSP is actually evaluating.

Capability	Awareness training	Single-frame deepfake	Identity / reputation	Live-call detection	Diopter Arc
Detects synthetic voice on a live call
Detects deepfake video frames
Verifies caller identity (reputation/biometric)
Models the conversation arc (pressure → ask)
Cross-channel correlation (video, voice, +)
Forensic evidence chain for incident review

Supported Partial Not supported

Real incidents

The arcs we'd have caught.

Public deepfake incidents, mapped to the move where Diopter would have intervened.

All field notes

Global engineering firm

2024 · Deepfake video conference

$25.6M

A finance employee joined a video call with a deepfaked CFO and 'colleagues' on camera, then authorized 15 transfers in sequence.

Caught at

authorityisolationask

The arc would have surfaced a synthetic-room signal across multiple participants well before the first wire was approved.

Residential closing wires

Q1 2025 · Email + voice impersonation

≈ $200M

Coordinated impersonation of title agents and closing attorneys redirected residential closing wires across 30+ states in a single quarter.

Caught at

authorityurgencyask

A verdict on the closing call attaches to the wire-instruction change before signature, breaking the redirect.

Mid-market bank

2024 · Cloned executive voicemail then call

$35M

A bank manager transferred $35M after a cloned voice call from a 'director' he had spoken with before, backed by spoofed email confirmation.

Caught at

authorityurgencyask

The arc accelerates toward an unscheduled wire while voice signal drifts off pattern, holding the transfer for review.

State-sponsored fake hires

2024 · Deepfake video interviews

+220% YoY

Operators use synthetic faces and AI-altered voices to pass remote interviews and infiltrate payrolls of US tech and finance teams.

Caught at

authorityisolationescalation

The same backing actor surfaces across rounds of the loop, exposing the persona before an offer is extended.

Integrations

Where Diopter plugs in.

Diopter meets your team on the calling tools and the management plane you already run.

Video conferencing

Native on the platforms your team already uses.

Voice and VoIP

Inline at the carrier or on the agent endpoint.

MSP and fleet

JamfIntuneKandjiConnectWiseDatto RMMMCP server

Push the agent through the management plane you already use, including agent stacks via MCP.

Plus a Communication Filtering API for inline trunk coverage where the carrier sits outside the listed providers.

For MSPs

Defend many tenants from one console.

Diopter is built so an MSP can stand it up across a book of clients without enterprise-grade procurement on either side.

01MSP

Multi-tenant console

One operator view, every client.

02MSP

Per-client policy

Verdict thresholds and routing per tenant.

03MSP

Billable line item

Packaged for MSP resale, not enterprise procurement.

Walkthrough · 30 min · NDA-safe

Walk an attack arc with our threat team.

We'll replay a real deepfake incident through Diopter, frame by frame and signal by signal, and show what you would have caught and when.

See a real attack arc Read the research