Security + risk teams

Detect vishing and executive impersonation on live calls

Deepfake CEO fraud and business email compromise now arrive as a video call, a voice note or a candidate interview. Resemble checks the audio and video behind each of them and tells your team before anyone acts on it

Contact us
case study

At a Fortune 500 health insurer, password resets run through an enterprise service desk of 300 agents. Every one of those resets rests on an agent recognizing a colleague they have only ever heard, which is the entire premise of a vishing attack.

300
agents on one service desk verifiying
callers by voice

Integrations

Detection runs where your people already talk to each other, and alerts land where your team already works.
Meetings: Microsoft Teams, Zoom, Google Meet, Webex, Cisco, and LiveKit.
Contact center: Genesys, Five9, 8x8, Avaya, Talkdesk, Verint, Oracle and others. Call streams forked over SIPREC, so nothing changes for the agent.
Telephony: Twilio, Vonage, RingCentral, Aircall, Cisco. Carrier and SIP trunk audio, including Teams phone calls.
View Integrations

Where deepfakes reach your people

Executive impersonation

Digital executive protection now means catching a cloned voice or a fabricated video of a named leader, sent to staff over messaging apps or posted publicly. CEO fraud and business email compromise arrive with a face and a voice attached to the request.

Live meetings

Someone joins a scheduled call with a face swap and asks for a wire, a credential or a document. Reviewing the recording afterwards is too late, so the check has to run while people are still talking.

Hiring and candidate fraud

A candidate interviews with one face and starts work as someone else, or never starts at all while a salary and a laptop go somewhere you did not intend.

Service desk and account recovery

A vishing attack works because an agent under time pressure hears a familiar voice and approves the reset. It is the softest entry point most organizations have, and the least monitored.

What your security stack catches, and what they miss

Your existing security tools are built to inspect links, attachments and endpoints. But a voice call can carry an impersonation attempt without triggering any of those checks.
The question Your current controls ✦Resemble
Is this email or link malicious? Email security, endpoint protection and your SIEM already handle this well. Nothing to add here, this part already works.
Is the person on this call real? Not assessed. The meeting platform authenticates an account, not the face and voice using it. Audio and video checked continuously during the call, with the synthetic participant named.
Is this actually our CFO, or someone using their face? Left to the judgement of whoever is on the call, usually someone junior to the person being impersonated. A match against voices and faces you have enrolled, so the answer does not depend on who is in the room.
Did the caller to the service desk sound like the employee? Knowledge questions and a voice the agent is trusting by ear. A synthetic voice flagged to the agent within seconds of the call opening, before the reset is approved.
Can you show the board what happened? An incident write-up assembled after the fact from people’s recollections. A report per detection, with the evidence and the reasoning recorded at the moment it was flagged.

What Resemble AI sends back

An alert your team can act on right away and a record that still makes sense a quarter later.
Result and risk level
Deepfake or authentic, with a confidence score and a risk level.
Liveness
Whether a real person was physically present when the video was captured, or whether it was fed in from somewhere else.
Malicious behavior
The attack type with reasoning behind it, covering executive impersonation, account takeover and virtual kidnapping.

5 questions to take to your next security review

Most security teams have a policy for phishing and nothing written down for a face on a call. These five questions surface the gap quickly.
If someone joined a call today as your CFO and asked for a transfer, what in your stack would stop it?
Which of your executives have enough public audio and video for a convincing clone, and do any of them know it?
What does your service desk do when a caller sounds right but fails a knowledge question?
Who verifies that the person who interviewed is the person who starts on Monday?
When an employee suspects a call was faked, where do they report it, and who picks it up?

Where it runs, and what happens to your data

Where it runs
Cloud, your own VPC, or fully on-prem. Air-gapped deployments are already in production with goveernment agencies.
What we keep
In memory processing is available, so a file is analyzed without being stored. Everything is encrypted at rest and in transit.
Certification
ISO/IEC 27001:2022 certified, and GDPR and HIPAA compliant. Full detail is in our trust center.
99.5%
Audio accuracy on the Podonos benchmark
250+
Generative models tested against
<1%
False positives and false negatives, independently benchmarked
Frequently asked questions
Does a bot have to join the meeting?
Detect analyzes how a voice was produced, not what's being said. It returns a deepfake confidence score in under 300ms with no transcription or recording, making it one-sided consent compliant. Language-agnostic across 54 validated languages.
Who sees the alert when someone is flagged?
That is yours to configure, and most teams start with the host and the security inbox rather than the whole call, because a public warning tips off the attacker and embarrasses the person if the flag turns out to be wrong.
How is this different from voice authentication in the contact center?
Voice authentication is asking whether the voice matches an enrolled customer, while deepfake detection is asking whether the voice was generated at all, which means a good enough clone can satisfy the first check and still fail the second.
Do we have to enroll our executives first?
Not for detection itself, which runs on any voice or face in the call without knowing whose it is. Enrollment is what turns a generic flag into a named one, so the alert can say which executive is being impersonated rather than only that something on the call is synthetic. Most teams start with the handful of people who are actually targeted.
Can it detect deepfakes of executives outside our own systems?
Yes, on media you bring to it. If a video of your chief executive turns up on a social platform or in a WhatsApp group, you can run it through the same detection and get a report you can attach to a takedown request.
What languages does it cover?
Audio detection covers 54 languages. The check runs on the acoustic signal rather than on a transcript, so it does not depend on understanding what was said. Teams operating in one market usually confirm their own language during the pilot before rolling out more widely.
Will it hang up a call or block a participant automatically?
It does not, because the action stays with your team. Security leaders consistently tell us that automatically cutting off a real executive would cause more damage than the attack it was meant to prevent.
Know what's real — and what's a real threat.
Join thousands of developers and enterprises detecting AI fraud and protecting their content with Resemble AI
Contact us