Virtual Kidnaps, Fake CFOs: Social Engineering Defense in the Age of AI (with Dr. Jessica Barker MBE)

In this episode of All Things Human Risk Management, host Eliot Baker is joined by Dr. Jessica Barker, MBE to dissect two fast-rising threats - voice-clone “virtual kidnaps” and live-meeting executive impersonation - and the human defenses that actually work when people are stressed.

‍

The new social engineering reality

Attackers don’t need much audio to clone a voice, and deepfaked “CFOs” can now appear credibly on Teams/Zoom. The playbook blends cheap AI with old-school cash pickups and urgency.

“A few seconds of audio is enough to create a convincing clone.”

‍

Emotions are the exploit

Panic, urgency, and flattery drive mistakes. Teach people to detect their own state first, then act.

“Look for communications that make you feel something - then slow down and verify.”

‍

Culture as a control

Empathy isn’t “soft.” It accelerates incident response by increasing early reporting and reducing shame.

“Psychological safety turns near-misses into fast containment.”

‍

Verification beats persuasion

Out-of-band checks stop both clone calls and fake-CFO meetings. Normalize the pause.

• Pre-agree money-move protocols (dual control, known-number callbacks).
• Ban approval via chat/video alone.
• Use code phrases or pre-shared signals for high-risk requests.

“Trust the pause, not the voice.”

‍

Story-first, stats-supported comms

Stories stick; stats validate. Use one story, one ask, one action per touchpoint to avoid overwhelm.

“Simplify without dumbing down - make the next step obvious.”

‍

Extend protection to home

Employees and families are targets. Provide a one-page “clone-call” script and refrigerator checklist.

• “If you get a distress call: Hang up → call known number → alert security/police.”
• Teach kids/parents the callback rule.

‍

What to train (and measure)

Shift from completion to capability under pressure.

• Train: pause-verify reflex, out-of-band habits, reporting without blame.
• Measure: time-to-report, verification rate before money/data actions, recovery after near-miss.

“Completion shows who watched; verification shows who’s safer.”

‍

Bringing leadership along

Translate behavior metrics into risk language (fewer incidents, faster containment, smaller losses). Pair dashboards with one memorable story.

“Don’t just show numbers - show how a verification habit prevented a transfer.”

‍

Takeaways you can implement this quarter

1. Ship a verification playbook (money/data changes require callback to a known number).
2. Launch a “trust the pause” micro-campaign (one behavior, repeated).
3. Add a clone-call family guide to your security portal.
4. Update incident comms to reward early reporting - no blame language.
5. Replace vanity KPIs with verification rate, time-to-report, and recovery metrics.