Deepfake Drill

Deepfake Drill Skill

The finance teams that lose seven figures to a cloned voice all describe the same call afterwards: it sounded exactly like him, he knew the deal names, he was stressed, it was 4:55pm on a Friday. Voice cloning needs seconds of audio now; the defense isn't detecting the fake — assume you can't — it's a process that holds even when the voice is perfect. This skill drills that process as a tabletop exercise: realistic pressure, your actual approval chain, and a debrief that fixes the gap the drill finds. It trains defenders; it does not help attackers — no cloning instructions, no evasion tips, ever.

What This Skill Produces

• A drill scenario pack tailored to your org: the pretext, the pressure timeline, the escalating asks — written for a facilitator to read aloud, not for realism tooling
• A facilitator script with decision points, expected-control checkpoints, and legitimate-looking curveballs ("the CFO is genuinely on a plane")
• A tells checklist the team keeps afterwards: process tells (urgency + secrecy + channel-switch + authority), not audio tells
• A gap report template: which control held, which was bypassed and how, the fix, the re-drill date

Required Inputs

Ask for (if not already provided):

• The process being drilled: who can request payments/changes, who approves, above what thresholds, through which channels
• The realistic attacker's knowledge: what's public about your execs, deals, vendors (assume LinkedIn + your press page)
• Who's being drilled and whether it's announced or unannounced (recommend announced-window: "a drill will happen this month" — trains without the trust damage of full ambush)
• Any real near-misses to build from

Process

1. Design the scenario around YOUR weakest legitimate path. The drill pretexts that work are the ones your process half-allows: the acquisition that's "still confidential", the vendor bank-detail change, the exec travelling. Pick one, build the pretext from information a real attacker could gather publicly.
2. Script the pressure, not the technology. The facilitator plays the caller using the three levers every real case uses — urgency (deadline in minutes), secrecy (tell no one, deal sensitivity), authority (the voice/name at the top) — plus the channel-switch ("can't do email, I'm boarding"). The script says what the caller says; it never explains how to clone a voice, and redirect any such request.
3. Let the process fail safely. Facilitator notes for each decision point: what the control should catch, what to say if the participant bypasses it, when to escalate the pressure once. No individual shaming — the drill grades the process, and the debrief says so out loud.
4. Debrief on tells and controls. The checklist that stays: any payment or detail-change request combining urgency + secrecy + channel-switch gets out-of-band verification on a known number, no exceptions for rank — the callback rule is the whole defense. Score which controls held.
5. Fix and re-drill. Every gap gets an owner, a fix, and a date; the re-drill uses a different pretext. Recommend an annual cadence and folding the callback rule into onboarding.

Output Format

## Drill scenario: [pretext name]
[Setup, what the attacker plausibly knows, the ask sequence, timing]

## Facilitator script
[Read-aloud beats · decision points with expected control · escalation and
curveball notes · hard stop conditions]

## The tells checklist (keep this)
[Process tells + the callback rule, one page]

## Gap report
| Control | Held / bypassed | How | Fix | Owner | Re-drill date |

## Aftercare
[The no-blame debrief framing + the announcement for the wider team]

Quality Checks

• The scenario is built from the org's own process and public information — generic scripts don't find real gaps
• Zero content that teaches attack technique: no cloning tools, methods, or detection-evasion — pressure is scripted as dialogue only
• The debrief framing is process-blame, not person-blame, explicitly
• The callback rule appears verbatim in the tells checklist with the "no exceptions for rank" clause
• Every gap in the report has an owner and a re-drill date

Anti-Patterns

• Do not produce actual cloned audio, cloning instructions, or tool recommendations for impersonation — decline that direction plainly, even "for realism"; the drill works as read-aloud tabletop
• Do not run fully unannounced ambush drills on individuals — announced windows train; ambushes traumatize and get the program cancelled
• Do not let the drill conclude "train people to hear fakes" — the defense is the callback rule, because the fakes are already good enough
• Do not skip finance-adjacent paths: payroll detail changes and vendor bank updates are the same attack in cheaper clothes

Related

[[scam-message-decoder]] for the text/email versions; [[oncall-runbook]] patterns for the verification procedure; [[incident-postmortem]] if drilling because a real attempt already happened.