AI voice & impersonation
Sounds human.
Still verify.
A convincing voice is an experience—not proof of identity. Protect sensitive actions with a verification process, not a guessing game.
What’s changing?
Block is showing us a possible future. Its Dessa demos feature AI conversations with interruptions, laughter, pauses, and expressive speech. As voice AI becomes more natural, an awkward pause or robotic tone is no longer something we can count on to spot it.
For security, the lesson is straightforward: a persuasive conversation should not replace verification. The caller may sound familiar, confident, or urgent. What matters is whether they are authorized to make the request.
How to stay safe
01 · Verify through a separate route
For an unexpected sensitive request, end the call and use a number from a trusted directory or previously verified contact. A callback number supplied by the caller is not independent verification. Caller ID can be spoofed.
02 · Keep approvals in the system
Payments, bank-detail changes, sensitive disclosures, and account recovery should follow an authenticated, approved workflow. A familiar voice, senior title, or urgent deadline must not bypass it. Use a second approver where required.
03 · Protect account access
Never give a caller your password, recovery codes, or sign-in verification codes. Do not approve a login prompt you did not initiate. Use passkeys or phishing-resistant MFA where available; they do not replace payment verification.
04 · Make pausing normal
“I’ll verify this through our usual process.” You do not need to prove a voice is artificial before declining an unverified request. Pressure to skip checks, keep a transaction secret, or install remote-access software is a reason to pause.
Already acted? Report it promptly.
Stop further action. Contact your IT/security team or service provider through a known channel. For money sent, contact your bank immediately. Preserve call details and messages according to policy. Reporting early helps; blame makes it harder.
You don’t have to detect the fake.
You need to verify the request.
Sources: Block: Dessa overview and original demos · NSA/FBI/CISA: Deepfake threats to organizations.
Follow your organization’s specific verification and incident-reporting procedures.