Skip to main content
Diopter
Log inBook a demo
Industry

Real-time social engineering defense for financial services

Diopter helps banks, funds, and payment teams confirm that the person asking to move money on a call is who they say they are, and that the request fits your policy. We test your people with simulated attacks, then assist them on their own calls with real-time alerts before a wire or beneficiary change clears.

Your first agentic attack is on usBook a walkthrough

A free simulated attack on a team you choose, with an NDA first if you want one.

What can Diopter help financial services teams do on calls?

Diopter helps financial services teams confirm who is on the call and hold wires, beneficiary changes, MFA resets, and client requests that don't fit policy, including fund administrators on payment and investor calls.

  1. Hold a wire when the "MD" calls with a deadline.

    A cloned managing director (MD) might join the payments call to get a wire released before a close.

  2. Check every beneficiary change by callback.

    A "custodian" or a long-standing vendor might confirm new bank details on video, with the right account history.

  3. Keep MFA resets for the right person.

    An "employee" on Teams might ask for a reset before the market opens.

  4. Know a private banking client is really the client.

    Someone who sounds like the client could call the relationship manager and ask to move funds out before a trip.

  5. Prove your controls to clients, auditors, and regulators.

    If they ask how you verify a payment instruction that arrives by phone or video, simulation results and the evidence trail from live calls can help you answer.

How does Diopter help stop wire fraud on a live call?

Diopter checks four things on every call, from the first second to the last.

Identity

Whether the caller and the instruction match your records, such as a managing director, custodian, or vendor that nothing in your records backs up, or a new beneficiary on a vendor you've paid for years

Mismatch

Voice and video

Cloned or text-to-speech voices, including one that appears only when the amount comes up, plus face-swap and lip-sync artifacts on video

Synthetic

Conversation

Pressure such as an "MD" who says the deal closes at five and wants it kept between the two of you

Pattern

Policy

Asks checked against your approval policy, such as a beneficiary change with no callback or a wire above the dual-approval threshold with only one approver on the call

Out of policy

The person on the call sees the alert, the reason, and a suggested next step, such as holding the wire for a second approver. A person decides with the evidence in front of them, and the transcript goes to your fraud team.

Which social engineering attacks have hit banks and financial firms?

Attackers have used cloned voices and face swaps against banks and financial firms to get transfers approved, bypass phone voice ID, and take out loans.

  1. A 2021 Forbes report, based on a US court filing, described how a bank branch manager in the United Arab Emirates approved transfers of about US$35 million after a call from what sounded like a company director he had spoken with before. Investigators said the attackers used AI to clone the director's voice, and emails from the "director" and a lawyer backed up the story.1

  2. In February 2023, a Vice journalist cloned his own voice with a free AI tool and used it to get past the phone voice ID at Lloyds Bank. He got access to his balance, recent transactions, and transfers.2

  3. In August 2023, Hong Kong police arrested six people who used stolen identity cards to make up to 90 loan applications to 20 banks and financial institutions. When a lender asked for a facial recognition check, the group used an AI face-swap program, which police said worked once. Four loans worth HK$200,000 were approved.3

These attacks follow the same pattern:

  1. The attacker uses a real identity, from a stolen ID card, a public recording, or a director the target already knows.

  2. AI fills the gap, with a cloned voice on the phone or a swapped face on a video check.

  3. The request fits a normal process, such as a transfer, a loan, or a phone login, so nothing looks out of place.

  4. The attack only stops when someone checks more than the face or the voice.

Why are financial services firms a target for social engineering?

Financial services firms are a target because attackers skip the login, which banks protect with single sign-on and MFA everywhere. The approval for a wire, a beneficiary change, or a reset still happens on a call, where a familiar voice does most of the persuading. The FBI recorded US$2.77 billion in business email compromise losses in 2024 and has warned that criminals bring AI-generated audio and video onto live calls to pass as executives and vendors.4 In November 2024, FinCEN warned financial institutions about a rise in suspicious activity reports describing deepfake media.5

How do social engineering simulations work for financial services teams?

Diopter runs simulated attacks against your treasury, payments, and help desk teams, with a cloned executive voice or deepfake video if you want it and the executive agrees. You see who spotted the attack and at which step, so you can harden your approval policy and your people. Do the dry runs with us through social engineering red teaming, so our agents hit you before a real attacker does.

  1. We'll run simulated wire, beneficiary change, and MFA reset calls built from real attacks

  2. You'll receive results by team and by policy step, so you know which teams to fix first

  3. The same scenarios then become the checks Diopter runs on live calls

How does Diopter roll out for a security team?

Diopter works with the platforms, deployment options, and retention settings below. Pilot with your payments team in days, then go wider through MDM once it's working.
  • OpenTelemetry native: logs flow into your SIEM, and EDR and MDR connect via API
  • Runs on Zoom, Microsoft Teams, Google Meet, and phone lines through Dialpad, RingCentral, or any carrier via API, with Webex coming soon
  • Captures calls with or without a bot, with nothing to install on the client's or vendor's side
  • Rolls out through MDM (Intune, Jamf)
  • Offers configurable data retention, including zero retention, and on-prem or hybrid deployments
  • Has completed a SOC 2 Type II audit

Two ways to start

Your first agentic attack is on us. Fill out the form, and we'll talk through how to run a simulated payment call on one of your teams. Want to talk about live-call defense instead? Book a walkthrough, and we'll replay a real deepfake payment call and show you what Diopter caught and when.

Your first agentic attack is on usBook a walkthrough

Common questions for security and finance teams

Can Diopter test our firm with a simulated attack first?

Yes. Diopter will run one simulated attack on one of your teams at no cost, such as a cloned executive voice asking treasury to release a wire. Most teams start there, then turn on the same scenarios for live calls.

How can banks detect deepfake voices in call center authentication?

Voice ID alone isn’t enough, because cloned voices have already passed bank phone checks in public tests. Diopter adds a check on the live call that scores the voice for cloning and the conversation for pressure. The check runs on contact center and phone lines, either inline at the carrier or on the employee’s device, and connects through Dialpad, RingCentral, or any carrier via API. It works alongside your knowledge-based checks and alerts the agent while the caller is still on the line.

What does deepfake detection for financial services check on a call?

Diopter's deepfake detection for financial services checks the voice and video for cloning, face swaps, and lip-sync artifacts for the whole call. It also compares the caller with your records, reads the conversation for pressure, and checks any asks against your approval policy.

Does this cover business email compromise and invoice fraud too?

Yes. Diopter covers the call that closes a business email compromise or invoice fraud attempt. The lookalike email sets it up, and the phone or video call is where the approver says yes. Diopter checks that call and the resulting wire or beneficiary change against your policy, and it works alongside your email security.

How should a bank evaluate a tool for wire fraud prevention?

Diopter recommends testing any tool on your own call traffic in a pilot. Ask how an alert turns into an action (such as a hold, a step-up check, or a route to a reviewer), how much integration work you need beyond the demo, and whether every alert leaves an evidence trail your audit team can read.

How does Diopter avoid false alarms on busy payments calls?

Diopter won't flag a normal payments call just because there's a real deadline. One urgent sentence or one glitchy camera doesn't set it off. Before it alerts, it needs to see the whole pattern, such as claimed authority, pressure, and an ask that keeps growing or skips a step your policy requires.

What should a financial services firm look for in social engineering defense?

Start with your own process. A callback on a number already on file and a second approver for wires, beneficiary changes, and MFA resets can stop many of these attacks without any tool. When you compare tools, run each one on your own payments and treasury calls during a pilot and measure how often it raises a false alarm, how fast the alert reaches the person on the call, and what it does with recordings and client data. Check that it covers the channels your team uses and fits your existing security tools and audit trail. The final decision should stay with a person. Your own pilot will tell you more than any vendor's benchmark, ours included.

Research behind deepfake detection for financial services

Sources
  1. Gizmodo, Oct 2021, citing Forbes, on the UAE bank voice-clone case.
  2. Biometric Update, Feb 24, 2023, citing Vice, on the Lloyds Bank voice ID test.
  3. The Standard (Hong Kong), Aug 25, 2023, on the deepfake loan-application arrests.
  4. FBI IC3 2024 Internet Crime Report, and FBI PSA I-120324-PSA, Dec 3, 2024.
  5. FinCEN Alert FIN-2024-Alert004, Nov 13, 2024.