Deepfake Vendor Impersonation

Attackers use AI-generated voice, video, imagery, and synthetic communications to impersonate trusted vendors, suppliers, partners, or service providers and manipulate enterprise personnel into changing payment details, disclosing sensitive information, approving transactions, or granting access.

Deepfake Vendor Impersonation applies synthetic-media technology to one of the enterprise’s most difficult trust boundaries: third-party relationships.

Attackers may clone the voice of a known vendor representative, generate convincing video, fabricate profile imagery, or combine synthetic media with compromised email accounts and legitimate information about an existing business relationship.

The attacker then impersonates a supplier, consultant, technology provider, financial partner, or other trusted third party to request a sensitive business action.

These attacks are particularly dangerous because the communication can contain accurate information about existing contracts, invoices, personnel, projects, or payment processes while simultaneously providing apparently convincing visual or audible proof of identity.

Organizations routinely interact with third parties through email, telephone, messaging, and video conferencing.

Attackers can research these relationships through public information, compromised communications, stolen invoices, vendor portals, social media, or previous intrusion activity.

Generative AI can then be used to reproduce the appearance or voice of an actual vendor representative.

The attacker may request a change to banking information, approval of an invoice, disclosure of credentials, access to an environment, modification of account ownership, or another sensitive action.

A sophisticated operation may begin through a compromised or lookalike email account and escalate to synthetic voice or video when the victim requests additional verification.

This allows the attacker to defeat a process that incorrectly treats a phone or video confirmation as independent verification.

1. Vendor Targeting
The attacker identifies an existing supplier, partner, consultant, or service provider trusted by the organization.

2. Relationship Intelligence
Information about vendor contacts, contracts, invoices, projects, payment schedules, and communication patterns is collected.

3. Synthetic Identity Creation
Voice, video, imagery, or other media representing a legitimate vendor contact is generated or manipulated.

4. Initial Contact
The attacker initiates communication through email, telephone, messaging, or another channel.

5. Identity Reinforcement
If challenged, synthetic voice or video is used to provide apparent confirmation of the vendor’s identity.

6. Sensitive Request
The attacker requests a payment change, transaction, credential, document, remote access, or modification to an existing business process.

7. Exploitation
The organization acts on the fraudulent request, resulting in financial loss, information disclosure, or unauthorized access.

• Accounts payable
• Vendor management systems
• Procurement platforms
• Financial approval workflows
• Email systems
• Video conferencing
• Enterprise telephone systems
• Vendor portals
• Supply-chain management systems
• Help desks
• Third-party remote access
• Contract management platforms
• Collaboration systems
• Banking and payment processes

Deepfake vendor impersonation can transform traditional vendor fraud and business email compromise into a multi-channel identity attack.

An employee who becomes suspicious of an email may believe they have verified the request after speaking with or seeing the apparent vendor representative, when the secondary interaction is itself synthetic.

Successful attacks can result in fraudulent payments, altered banking information, credential compromise, sensitive-data disclosure, unauthorized third-party access, supply-chain compromise, and substantial financial loss.

The enterprise control lesson is critical: changing communication channels does not provide independent verification if an attacker can impersonate the same trusted identity across those channels.

Authorized testing should assess whether synthetic vendor communications can circumvent third-party verification controls.

Testing scenarios may include:

• Vendor banking-information changes
• Invoice approval requests
• Emergency payment requests
• Requests for confidential documents
• Vendor account recovery
• Third-party access requests
• New user provisioning
• Changes to authorized vendor contacts
• Voice confirmation
• Video confirmation
• Multi-channel verification scenarios

A particularly important test is whether employees consider synthetic voice or video to be independent confirmation of an email request.

Testing should use approved identities, controlled communications, and simulated financial actions.

Monitor for:

• Changes to vendor banking information
• Unexpected payment instructions
• New communication channels from existing vendors
• Changes in vendor contact information
• Requests involving unusual urgency or secrecy
• Lookalike email domains
• Unexpected voice or video verification
• Vendor communications originating from unusual infrastructure
• Attempts to bypass established procurement procedures
• New remote-access requests
• Transactions inconsistent with historical vendor behavior
• Sensitive changes immediately following identity verification

Financial, identity, and communications telemetry should be correlated where possible.

MITRE ATT&CK T1656 – Impersonation Additional ATT&CK techniques may apply if the impersonation leads to phishing, valid-account access, credential theft, or compromise of third-party connectivity.

No direct OWASP LLM Top 10 mapping. This is primarily a third-party impersonation and social-engineering attack enabled by generative AI rather than exploitation of an LLM application's security boundary.