Wherever your team picks up a call, attackers are already on the line.

AI social engineering rides into the business on the same video and voice channels your customers, vendors, and executives use every day.

See a real attack arc See the platform

Threat surfaces

The two channels where AI is learning to lie.

Almost every AI social-engineering attack we investigate lands on a video call, a voice call, or a handoff between the two. Diopter scores the attacker's moves as they happen and turns the result into a verdict the workflow can act on.

Surface 01

Video

Deepfake faces, synthetic candidates, and executive impersonation on conferencing. Identity drift across a single call, or across an entire multi-round loop, gets caught well before the ask ever lands.

› Attacker moves: face swaps, lip-sync replays, proxy interviewers, cloned execs on closing calls.
› Verdict outcome: verified · possible · suspected · high-risk, attached to the call record.

Native on

Surface 02

Voice

Voice clones, vishing, and vendor or partner impersonation across the trunk and the softphone. Coverage sits inline at the carrier or on the agent endpoint, with no install required on the caller side.

› Attacker moves: cloned-exec wire authorizations, synthetic FNOL, vendor-change calls, partner impersonation.
› Verdict outcome: routed to the approver, the SIU file, or the wire ticket at the moment of decision.

Inline with

By industry

How that coverage shows up where your money moves.

Seven industries where AI social engineering is already converting into measurable loss. Each section walks through what attackers actually do on the call and which use cases we cover in response.

Real Estate

Video + Voice

Closing-wire redirects via cloned title agents and attorneys.

Q1 2025 saw deepfake title agents and cloned closing attorneys redirect over $200M in buyer wires. The redirect lands on the verification call between buyer and closer, minutes before funds move.

Closing-table identity

Workflow

Buyer, seller, attorney, and title or escrow agent all on one call minutes before funds move.

Attacker move

Cloned attorney or title agent pushes a wire-instruction change in the final verification window.

Verdict moment

Every party on the closing call carries a verdict before disbursement is released.

Wire & payment approvals

Workflow

Treasury, AP, closing, or funding desk authorizes an outbound wire on a call.

Attacker move

Voice-clone of an exec, partner, or counterparty pushes a last-minute account or amount change.

Verdict moment

Hold the wire until identity on the originating call clears.

Vendor & partner verification

Workflow

Inbound call from a known vendor, banker, or counterparty requesting a change.

Attacker move

Cloned voice or deepfake video impersonates the vendor to redirect funds, data, or access.

Verdict moment

Verdict attaches to the change request before it lands in the system of record.

Staffing & Recruiting

Video

Synthetic candidates and proxy interviewers placed into client environments.

Synthetic candidates, proxy interviewers, and state-sponsored IT workers have become a fixture of the modern hiring loop. The same backing actor hides behind a different on-screen face from round to round, right up until the offer lands.

Recruiting & interview loops

Workflow

Screens, tech rounds, and onsite interviews on Zoom, Teams, Meet, or coding platforms.

Attacker move

A synthetic candidate, proxy interviewer, or state-sponsored IT worker hides behind a deepfake face.

Verdict moment

Identity linked across rounds; verdict per loop before offer.

Post-offer placement & onboarding

Workflow

Offer acceptance, I-9, equipment handoff, and first-day access for a newly placed worker.

Attacker move

The person who showed up for interviews is not the person who logs in on day one.

Verdict moment

Identity binds across the loop, the offer, and first access, so a swap at handoff is caught.

Customer & claimant intake

Workflow

Support, FNOL, onboarding, or KYC calls that establish identity and start a payout path.

Attacker move

Synthetic claimant or cloned customer files a fabricated request with stolen PII.

Verdict moment

Verdict at intake routes the case to investigation before funds move.

Financial Services

Video + Voice

Voice-clone authorizations and deepfake exec wires across mid-market banks and credit unions.

Average loss runs $35M per incident. Deepfake CFO calls and voice-clone authorizations have become routine across treasury, private banking, and the call center, anywhere authority moves money.

Wire & payment approvals

Workflow

Treasury, AP, closing, or funding desk authorizes an outbound wire on a call.

Attacker move

Voice-clone of an exec, partner, or counterparty pushes a last-minute account or amount change.

Verdict moment

Hold the wire until identity on the originating call clears.

Executive impersonation on internal calls

Workflow

A senior leader drops into a Teams or Zoom and instructs staff to override a control under time pressure.

Attacker move

Cloned CFO, managing partner, or senior banker authorizes an exception that bypasses normal review.

Verdict moment

Verdict surfaces beside the leader's tile so staff can refuse the override on the call.

Customer & claimant intake

Workflow

Support, FNOL, onboarding, or KYC calls that establish identity and start a payout path.

Attacker move

Synthetic claimant or cloned customer files a fabricated request with stolen PII.

Verdict moment

Verdict at intake routes the case to investigation before funds move.

Insurance

Voice

Synthetic claimant calls, fraudulent FNOL, and impersonation of adjusters.

Fraud growth is outpacing controls. Voice-clone FNOL, synthetic claimants, and impersonated adjusters route payouts to attacker accounts before SIU ever touches the file.

Customer & claimant intake

Workflow

Support, FNOL, onboarding, or KYC calls that establish identity and start a payout path.

Attacker move

Synthetic claimant or cloned customer files a fabricated request with stolen PII.

Verdict moment

Verdict at intake routes the case to investigation before funds move.

Adjuster & investigator impersonation

Workflow

Callbacks between the adjuster, the claimant, and the special investigations file.

Attacker move

Attacker impersonates the adjuster to the claimant, or the claimant to the investigator, to keep a fraudulent file moving.

Verdict moment

Both sides of the callback carry a verdict that follows the claim record.

Vendor & partner verification

Workflow

Inbound call from a known vendor, banker, or counterparty requesting a change.

Attacker move

Cloned voice or deepfake video impersonates the vendor to redirect funds, data, or access.

Verdict moment

Verdict attaches to the change request before it lands in the system of record.

CPA & Tax

Voice

Voice-clone partner calls during filing season trigger out-of-band wire and tax-return changes.

The highest-pressure window of the year is when staff are least likely to push back on a partner. Cloned voices change refund routing and wire instructions in the final hours before filing.

Executive impersonation on internal calls

Workflow

A senior leader drops into a Teams or Zoom and instructs staff to override a control under time pressure.

Attacker move

Cloned CFO, managing partner, or senior banker authorizes an exception that bypasses normal review.

Verdict moment

Verdict surfaces beside the leader's tile so staff can refuse the override on the call.

Wire & payment approvals

Workflow

Treasury, AP, closing, or funding desk authorizes an outbound wire on a call.

Attacker move

Voice-clone of an exec, partner, or counterparty pushes a last-minute account or amount change.

Verdict moment

Hold the wire until identity on the originating call clears.

Vendor & partner verification

Workflow

Inbound call from a known vendor, banker, or counterparty requesting a change.

Attacker move

Cloned voice or deepfake video impersonates the vendor to redirect funds, data, or access.

Verdict moment

Verdict attaches to the change request before it lands in the system of record.

Law

Video + Voice

Deepfake client onboarding and trust-account fraud via cloned managing-partner instructions.

Deepfake client onboarding paired with voice-cloned partner instructions reaches into the IOLTA. Bar exposure follows the wire, which means the loss itself becomes the regulatory event.

Closing-table identity

Workflow

Buyer, seller, attorney, and title or escrow agent all on one call minutes before funds move.

Attacker move

Cloned attorney or title agent pushes a wire-instruction change in the final verification window.

Verdict moment

Every party on the closing call carries a verdict before disbursement is released.

Executive impersonation on internal calls

Workflow

A senior leader drops into a Teams or Zoom and instructs staff to override a control under time pressure.

Attacker move

Cloned CFO, managing partner, or senior banker authorizes an exception that bypasses normal review.

Verdict moment

Verdict surfaces beside the leader's tile so staff can refuse the override on the call.

Customer & claimant intake

Workflow

Support, FNOL, onboarding, or KYC calls that establish identity and start a payout path.

Attacker move

Synthetic claimant or cloned customer files a fabricated request with stolen PII.

Verdict moment

Verdict at intake routes the case to investigation before funds move.

Mortgage

Video + Voice

Impersonation of loan officers and processors at funding to redirect borrower wires.

Per-loan losses run six figures or more when borrower wires get redirected. The attack lands on the call between LO, processor, and borrower inside the funding window.

Funding-call borrower verification

Workflow

Final verification call between loan officer, processor, and borrower inside the funding window.

Attacker move

Synthetic borrower or cloned loan officer redirects proceeds at the last identity step before funds release.

Verdict moment

Funding holds until the borrower and the originating staff both clear on the call.

Closing-table identity

Workflow

Buyer, seller, attorney, and title or escrow agent all on one call minutes before funds move.

Attacker move

Cloned attorney or title agent pushes a wire-instruction change in the final verification window.

Verdict moment

Every party on the closing call carries a verdict before disbursement is released.

Vendor & partner verification

Workflow

Inbound call from a known vendor, banker, or counterparty requesting a change.

Attacker move

Cloned voice or deepfake video impersonates the vendor to redirect funds, data, or access.

Verdict moment

Verdict attaches to the change request before it lands in the system of record.

Walkthrough · 30 min · NDA-safe

Walk an attack arc with our threat team.

We'll replay a real deepfake incident through Diopter, frame by frame and signal by signal, and show what you would have caught and when.

See a real attack arc Read the research