Vishing Prevention Software: Lessons From the Dutch Deepfake Bank Fraud

A Deepfake Opened 47 Bank Accounts. Voice Is the Next Front: How to Choose Vishing Prevention Software

In Amsterdam, a 34-year-old man opened 47 fraudulent accounts at ABN AMRO, one of the largest banks in the Netherlands, without ever walking into a branch. He did it through the bank's mobile onboarding flow, which asks an applicant to photograph an ID and take a selfie so an automated system can confirm the two faces match. Using face-swap software, he blended his own features onto the photos of stolen identity documents until each selfie matched its ID well enough to pass. The bank mailed debit cards to accounts opened in other people's names, 47 times. He was convicted in June 2026 and sentenced to 30 months, with the court ordering him to repay the bank more than 13,000 euros (ECLI:NL:RBAMS:2026:6093, reported by DutchNews and analyzed by iProov).

What should stop any security leader is how ordinary the tools were. He harvested identity documents by posting a fake apartment listing on Marktplaats and asking interested renters to send a passport and a payslip "to verify" their application. The deepfakes came from off-the-shelf software. The scheme ran for months and was caught not by the automated check but by a human reviewer who noticed one application paired a woman's ID with a selfie showing a man's face. The verification system confirmed the face matched the document. It had no way to confirm the face was real.

That same generative capability does not stop at the camera. The model that grafts a face onto a stolen passport can clone a voice from a minute or two of audio. And the channel where most of your employees still extend trust by default, the phone, has almost none of the controls a bank wraps around account opening. If a synthetic face can defeat a verification system built to stop exactly that, a synthetic voice on an ordinary call is the more immediate worry, because almost nothing stands between it and the person who picks up.

Why the bank's deepfake problem is your voice problem

It is worth being precise about what happened in Amsterdam, because the lesson that transfers is not the obvious one. ABN AMRO was not the victim of voice phishing. It was beaten at identity proofing, in what Dutch prosecutors called a biometric injection attack: synthetic imagery fed into a verification pipeline that checked for a match but not for a living, present human. That is a know-your-customer problem, and the fix for it lives in the bank's onboarding stack, not in its phone lines.

But look at what bracketed the technical attack on both ends, and the relevance to everyone else becomes clear. On the front end, the fraud started with social engineering: real people, in a competitive housing market, handed over their passports because a "landlord" asked them to. On the back end, the accounts were not the goal. They were mule accounts, used to launder cash and to run follow-on bank-helpdesk fraud against other victims. The compensation the court ordered included reimbursing someone who lost money to that helpdesk scam. The deepfake sat in the middle of a chain whose first and last links were both ordinary human manipulation.

Voice is where that manipulation scales next, because the economics just changed. The defining example is the 2024 case in which a finance employee at the engineering firm Arup joined a video call with what looked like the company's CFO and several colleagues, every one of them a deepfake, and transferred roughly 25 million dollars. The same toolkit that produced that call now produces a single cloned voice on demand. An attacker no longer needs a fluent native speaker, a convincing accent, or a script delivered without nerves. They need a short sample of the person they want to imitate, and for executives and IT leaders that sample is often sitting in a public webinar, an earnings call, or a conference recording.

So the durable takeaway from the ABN AMRO case is not "buy better liveness detection," though banks should. It is that synthetic media has made impersonation cheap and convincing across every channel at once, and the channel your staff are least prepared for is the one ringing on their desk.

Vishing is now a top way into financial firms

This is no longer a fringe vector, and the most credible threat reporting now says so plainly. Mandiant's M-Trends 2026 ranked voice phishing the second most common initial infection vector observed in 2025, present in 11 percent of intrusions where investigators could identify how the attacker first got in. Verizon's 2026 Data Breach Investigations Report went a step further and began tracking pretexting over synchronous voice and chat as its own category, separate from email phishing, accounting for roughly 6 percent of initial access against email's 16. When the two most-cited incident datasets in the industry both carve out voice as a distinct way in, the category has matured.

The financial sector sits squarely in the blast radius, for a simple reason: the actions attackers want are the actions your people are authorized to take by phone. The FBI's 2025 Internet Crime Report tied business email compromise, which increasingly rides on a confirming phone call, to more than 3 billion dollars in reported losses, and AI-related complaints to nearly 893 million. The targets follow the authority and the access:

• The help desk. Groups operating in the Scattered Spider mold call IT support, impersonate an employee, manufacture urgency, and talk an analyst through a password or MFA reset. The phone is the weapon because a human can be pressured in ways a login form cannot.

• Finance and accounts payable. A cloned executive voice confirming an "urgent, confidential" wire, or a vendor calling to update bank details, turns a routine approval into a payout.

• Anyone who controls a SaaS login. Clusters tracked as ShinyHunters and UNC6040 have used vishing to coax credentials and one-time codes out of employees, then pivoted into Salesforce, Okta, and Microsoft 365 to steal data for extortion, as Google's threat intelligence team documented.

The broader telemetry points the same way, even if the precise figures should be read as directional. Widely cited vendor reporting put the rise in voice phishing across the second half of 2024 at 442 percent, and analysts at Deloitte have projected generative-AI-enabled fraud losses approaching 40 billion dollars by 2027. Methodologies vary and these numbers are not directly comparable, but the direction is not in dispute, and it is corroborated by the harder Mandiant and Verizon datasets.

Why "just listen for the glitch" stopped working

The instinctive defense, training people to recognize a fake by ear, is already obsolete, and it is worth being blunt about why so that nobody builds a program on it.

People cannot reliably hear the difference. In a 2026 study of how listeners judged synthetic versus genuine voices in realistic vishing clips, participants averaged about 37.5 percent accuracy (arXiv). That is worse than a coin flip, because the cues humans reach for, warmth, hesitation, the right accent, are exactly what modern voice cloning reproduces well. "Does this sound like them?" is no longer a usable control, and leaning on it actively works in the attacker's favor.

Machine defenses on the voice channel are not a finished answer either. Research published in 2026 found that current voice-cloning methods can bypass automated speaker-verification systems, and that anti-spoofing detectors trained on known synthesis techniques generalize poorly to methods they have not seen (arXiv). Voice biometrics still have a place as one signal among several, but treating a voiceprint as proof of identity invites the same failure ABN AMRO hit: a check that confirms a match without confirming authenticity. Caller ID deserves even less trust, because it is trivially spoofed, and a number that resolves to "Finance" or to a known vendor is precisely what an attacker will arrange to show.

The throughline across all of these is that voice is not a trust anchor. Anything an employee can see on the screen or hear in their ear can now be manufactured. A defense that survives that fact cannot depend on the target detecting the fake.

What actually stops voice phishing: a verification reflex you can rehearse

If the fake is undetectable in the moment, the control has to live in the process, not the perception. The single rule that holds regardless of how convincing the caller is: no sensitive action completes on the strength of a phone call alone. Moving money, resetting a credential or MFA factor, enrolling a new device, granting remote access, changing a vendor's bank details, exporting customer data, any of these requires confirmation through a separate, pre-established channel before it proceeds. The caller does not get to choose the channel, and the employee does not skip it because the request feels legitimate. Done right, it does not matter whether the voice is real, because the voice was never what authorized the action.

That is a behavior, and the reason most organizations do not have it is that they wrote it into a policy instead of building it into a reflex. Under pressure, on a call engineered to feel urgent and authoritative, people do what they have practiced, not what a document tells them. A finance manager who has never refused a convincing "CFO" before will hesitate to do it for the first time at the worst possible moment. The goal is to make stopping, verifying through the known channel, and reporting the attempt the path of least resistance, so often rehearsed that it is automatic.

Technology helps at the edges, but it is important to be clear about what each layer does and does not cover, because none of it removes the human decision:

• Telecom authentication such as STIR/SHAKEN attests that a call traversed the network without its caller ID being spoofed. That is useful, but it speaks to call-path integrity, not to the caller's intent or their authority to make the request. A perfectly attested call can still be a scam.

• Identity-verification and liveness tools are what ABN AMRO needed, and what banks should add to onboarding. They confirm a real, present person at the point of capture. They protect your customer-facing KYC flow. They do nothing for the call an attacker places to your help desk.

That leaves the human layer, and the only proven way to harden it is to rehearse it. Generic annual awareness training does not teach a support analyst what to do when a believable caller invents an emergency, because it never puts them in one. Realistic vishing simulation does: it places employees in a safe but convincing version of the real call, measures whether they followed the verification process, and turns each failure into a specific, timely lesson. Run it where the risk concentrates, the help desk, finance, executive assistants, and contact-center staff, and you are training people against AI voice scams the way pilots train in simulators: by failing harmlessly until the right response is muscle memory.

How to evaluate vishing prevention software

A note on the category before the criteria, because the label is loose. "Vishing prevention software," in the sense most security teams actually buy, means AI-driven simulation and awareness platforms that rehearse the human response to a voice attack. That is a different lane from the telecom and liveness tools above, which sit in front of the call or inside KYC. The platforms below do not block calls or detect a live deepfake on the wire. They build and measure the verification reflex that stops the attack from succeeding once it reaches a person. Evaluate them on how well they do that.

Eight criteria separate a serious platform from a checkbox:

1. Live, adaptive AI calls, not robotic voicemail. The simulation should be a real conversation that responds to what the target says, because that is what an attacker does. Pre-recorded voicemail drops and rigid scripts do not test how someone holds up when a caller improvises around their objections.

2. Deepfake and voice-cloning support, with governance. Cloning an executive's voice for a simulation is the most realistic test available and the most sensitive. The platform should support it and surround it with consent, access controls, and clear policy, because cloning a named individual carries privacy and employment implications that vary by jurisdiction.

3. Multi-channel realism. Real intrusions move across channels: a call that follows a phishing email, or a text that primes a later call. Look for coordinated hybrid voice-and-email campaigns (and ideally smishing) run as one workflow, not three disconnected tools.

4. Role-based targeting. Risk is not evenly distributed. The platform should let you build and aim scenarios at help desk, finance, executives, and contact-center teams, with pretexts that fit each role.

5. Vishing-specific metrics. Email open rates tell you nothing about a call. You need answer rate, failure rate, call duration, and trend lines over time, so you can show whether the verification reflex is actually improving.

6. Automatic follow-up training. The teachable moment is right after a failure. Look for remediation that triggers automatically when someone falls for a simulated call, not a report that a manager might act on weeks later.

7. Compliance and regional fit. For European financial firms operating under NIS2 and DORA, multilingual delivery and audit-ready reporting matter, as does the consent and data handling around recording and cloning voices for tests.

8. Safety and realism controls. Features like previewing a simulation before it launches, and cooling periods that prevent hammering the same employee, keep a program realistic without becoming punitive or chaotic.

The five platforms below all run genuine voice simulations and are worth a shortlist. They differ most on call realism, how deep their AI-driven scenario design goes, and whether voice is a first-class capability or one feature inside a broader suite.