AI Deepfake Impersonation: The Setup Email That Reaches the Inbox Before the Cloned Call
Deepfake impersonation led AI-driven attacks in 2026. The setup email that arranges the cloned call is the one step email security sees. How to read it.
AegisAI Threat IntelligenceAegisAI Threat Watch · Deepfake impersonation
AI Deepfake Impersonation: The Setup Email That Reaches the Inbox Before the Cloned Call
A cloned voice asks an employee for a wire, a bank-detail change or an MFA approval. The email that arranged the call carried no link or attachment, and it is the one step of the attack that lands in a mailbox. Deepfake impersonation led AI-driven attacks in 2026 at 45%, and phishing stayed the top way in for a fourth year.
An AI deepfake impersonation attack puts a cloned voice or face of an executive, a vendor contact or an IT staffer in front of an employee who can move money or approve a sign-in. It hits finance teams, help desks and account administrators, and in the 2026 Cost of a Data Breach study of 602 breached organizations it was the most common form of AI-driven attack, at 45%.
Phishing was the top way into breached organizations for the fourth year running, and in the email-borne form of this attack the phishing message is a plain email that arranges a call. It carries no link and no attachment, which is why a control that looks only for payloads passes it, and it is the one step of the attack that lands in a mailbox, where email security can act before anyone is on the phone. This post takes that email apart.
Source: IBM and Ponemon Institute, Cost of a Data Breach Report 2026, Figures 10, 20, 21 and 22, covering breaches at 602 organizations between March 2025 and February 2026. Cost figures are averages across every breach in each category, not deepfake incidents on their own.
Key judgments
- The inbox is still the way in, even when the deepfake is the weapon. Phishing led initial attack vectors for the fourth year and impersonation led AI-driven attacks; in the email-borne form of this attack, the message that arranges the call is where the two meet.
- The setup email carries no payload, so payload-based controls have nothing to act on. It has no link to follow and no file to open, and it often comes from a real account; what is malicious is the request, and only a control that reads the request can see it.
- The signals are in the sender and the ask. A lookalike domain registered days ago, a reply-to that differs from the from address, a known name on a first-time sender, a phone number not on file, and a request to leave the thread are what an email security control has to work with. This is AegisAI's analysis of the pattern.
- The clone passes the identity check people trust most. Colleagues verify each other by voice and face, and the study records that generative AI has made social engineering cheap to create and hard to detect, and that attackers use it to get past identity controls.
- AI-driven breaches cost USD 1 million more, and the actions this attack produces settle fast. A wire clears, a bank-detail change persists across later invoices, and an approved push prompt yields a valid account, which the study prices at USD 5.07 million per breach.
What is an AI deepfake impersonation attack?
An AI deepfake impersonation attack uses a synthetic voice, video or image of a real person to get an employee to take an action that person would be entitled to request: approve a payment, change a supplier's bank details, read out a one-time code, or approve a sign-in prompt. The attacker does not need to break a control. The attacker borrows the person the control trusts.
What the study measured
For the second year, Ponemon Institute asked breached organizations whether the attack on them used AI and, if so, what form it took. Among organizations that suffered a malicious attack, 25% said it was AI-driven, 64% said it was not, and 11% could not tell. The 25% is a 56% increase on the previous year's study, and among the AI-driven attacks, deepfake or impersonation led by a wide margin.
| Type of AI-driven attack | Share of AI-driven attacks |
|---|---|
| AI deepfake or impersonation attack | 45% |
| AI-enabled malware | 19% |
| AI-generated phishing or other communication | 17% |
| Other | 19% |
Figure 21 of the study. Deepfakes and other forms of impersonation are counted together.
The study's explanation for the volume is short: generative AI makes social engineering cheap to create and hard to detect, so attackers use it to trick users and bypass identity controls. The same study puts phishing, a category that includes voice and SMS phishing, at the top of initial attack vectors for the fourth year, used in 17% of breaches at USD 5.29 million each, and social engineering such as help desk impersonation and MFA fatigue next at 13% and USD 5.23 million.
How does a deepfake impersonation attack run?
In its email-borne form it runs as a research step, a setup email, a cloned call, an authorized action and a long silence. No published figure says how often a message precedes the call, so the sequence below is AegisAI's reading of the form an email security team can act on; where a step maps to a published figure, the figure is cited.
- Research. The attacker collects the organization's reporting lines and the voice or face to clone, and earnings calls, conference talks, podcasts, video posts and voicemail greetings give the sample. Names, roles and contact details are often already in circulation: customer PII was taken in 52% of the breaches in the study and employee PII in 35%.
- The setup email. A message from a lookalike domain, a free-mail address carrying the executive's display name, or a compromised vendor mailbox opens a thread about a confidential deal, an overdue supplier payment or a locked account that IT needs to fix. It asks for a call or names a time, and it carries no link and no attachment.
- The call. A cloned voice phones, or a cloned face joins a video meeting, with a short script and a specific request. Urgency and confidentiality close the exits: keep the usual approver out of it, finish before the bank's cutoff, keep it off the thread.
- The action. The employee sends a wire, changes a vendor's bank details, reads out a code, or approves a push prompt. In the study's categories this is where a breach is counted: phishing including voice phishing (USD 5.29 million), social engineering including help desk impersonation and MFA fatigue (USD 5.23 million), or abuse of a valid account (USD 5.07 million).
- The silence. The thread goes quiet, and the money is settled or the account is in use. Across all breaches in the study, identification took 183 days on average.
What does the setup email look like?
It looks like ordinary business mail with one request in it: talk to me, now, off this thread. This section is AegisAI's analysis of the pattern, drawn from how business email compromise lures are built, and it describes the three senders the three variants of the attack use.
Three senders, three lures
| Variant | Where the email comes from | What it asks for | Where the study counts it |
|---|---|---|---|
| Executive impersonation | A lookalike domain, or a free-mail address with the CEO's or CFO's display name | A quick call about a confidential deal; a wire before a deadline | Phishing (voice): USD 5.29M per breach |
| Vendor impersonation | A compromised supplier mailbox replying inside a real invoice thread, or a lookalike of the supplier's domain | A call to confirm new bank details on an open invoice | Phishing (voice): USD 5.29M; a business partner compromise adds USD 227,250 |
| Help desk impersonation | An IT-themed sender, often paired with a Teams chat or a flood of subscription mail | A call to reset a password or re-enrol MFA, or a push approval | Social engineering: USD 5.23M; valid account abuse: USD 5.07M |
Mapping by AegisAI. Costs from Figures 10 and 33 of the study, averaged across every breach in each category. The help desk form is taken apart in Teams help desk impersonation; the vendor form in vendor impersonation email detection.
What survives in a message with no payload
Stripping the link and the attachment removes what a scanner detonates. It does not remove the sender's history, the headers, or the request, and those are where the message gives itself away.
| Signal in the message | What a payload-based filter sees | What a control that reads the request sees |
|---|---|---|
| A domain registered days ago, one character off the real one | A sender with no bad reputation yet | A new domain imitating a known one, on a message that names a known person |
| Reply-to address that differs from the from address | Valid headers | Replies routed to a mailbox the displayed sender does not own |
| A known executive's name on a first-time sender | A new contact | A display name the organization knows, on an address it has never seen |
| A compromised vendor mailbox inside a real thread | SPF, DKIM and DMARC pass; a known correspondent | A change of ask inside the thread: new bank details, a call, a new number |
| A phone number or chat handle not on file | Plain text | A request to move the conversation to a channel the organization does not hold |
| Urgency plus secrecy: before the cutoff, tell no one | Plain text | The two pressures business email compromise lures run on |
AegisAI's analysis. A compromised account passes authentication because the mail is genuinely sent from the account; see why DMARC-passing emails can still be phishing.
The payload is not in the message. The request is, and the request is what the inbox can still catch.
AegisAI Threat IntelligenceWhy does an AI-driven breach cost USD 1 million more?
The study gives the number and a reason. A malicious AI-driven breach cost USD 6.04 million on average against USD 5.03 million for a malicious breach without AI, and the gap comes from AI letting attackers increase their velocity and scale, compressing timelines from weeks to days and raising the downstream business impact. The figure covers AI-driven breaches of every kind, not deepfake incidents on their own.
Applied to the email-borne form of this attack, AegisAI's reading is that each outcome settles before detection has a chance. A wire is a settled transaction, a changed bank detail persists across every later invoice, and an approved push prompt yields a valid account, which the study prices at USD 5.07 million per breach and which ran 243 days from entry to containment.
The clock, by how the breach began
| Initial attack vector | Average cost | Days to identify | Days to contain | Total |
|---|---|---|---|---|
| Phishing (includes voice and SMS phishing) | USD 5.29M | 186 | 65 | 251 |
| Social engineering (help desk impersonation, MFA fatigue) | USD 5.23M | 190 | 64 | 254 |
| Abusing valid accounts | USD 5.07M | 179 | 64 | 243 |
| All breaches in the study | USD 4.99M | 183 | 64 | 247 |
Figures 5, 10 and 13 of the study: averages across all breaches that began with each vector, not deepfake incidents on their own. Breaches that took more than 200 days to identify and contain cost USD 5.65 million on average; those under 200 days cost USD 4.32 million.
Why email security controls miss the setup email
Each control sees a step that looks legitimate on its own. This section is AegisAI's analysis of the email-borne form of the attack.
A gateway tuned to payloads passes it. There is no link to follow and no attachment to open, so sandboxing and URL rewriting have nothing to work on, and a short business message asking for a call reads as a short business message asking for a call.
Authentication passes when the sender is real. A compromised vendor mailbox sends genuine mail, so SPF, DKIM and DMARC all pass, and a lookalike domain set up for the campaign can publish its own records and pass as well. Reputation checks have little to hold on to when the domain is days old and has sent nothing bad yet.
The deepfake itself happens on a channel email security never sees. The voice call and the video meeting sit outside the mailbox, and the message that arranged them is the only trace the inbox ever holds. People then verify by voice and face, the check the study says attackers use generative AI to get past, and training built around email red flags such as odd links and misspellings leaves the call itself unrehearsed. The programs that cover the call are described in simulations beyond the inbox.
The action is legitimate on paper. A wire from the CFO's office, a bank change confirmed by the vendor and a push prompt approved by the account holder are each an authorized action by an authorized person. The study adds that AI compresses attack timelines from weeks to days, so a lure that once needed a week of research and a convincing actor now needs a public recording and an afternoon.
How AegisAI protects against it
The setup email is the step AegisAI sees. It has no link or file to analyse, and what it does have is a request: talk to me, on this number, before the deadline, and keep it quiet.
Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.
Where the call ends in an approved push prompt and a valid account, the compromised session is the next thing to catch. When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.
More on how that works: inbound email security and how to prevent business email compromise.
What is still unknown about deepfake impersonation
The split between cloned and human impersonation. The 45% figure counts synthetic voice and video together with a person pretending to be someone else, so the share of attacks that used a cloned voice or face is not public.
The channel mix. No published figure separates phone, video, email and chat, or says how often a message arranges the call. This post describes the email-borne form because that is the form email security can act on.
The price of the deepfake alone. USD 6.04 million is the average for malicious AI-driven breaches of every kind. A per-incident cost for deepfake fraud, and wire losses counted apart from breach costs, are not published.
How much goes uncounted. Whether an attack used AI is reported by the breached organization itself, and 11% could not tell, so the true share of AI-driven attacks may sit above 25%.
MITRE ATT&CK mapping
This mapping is AegisAI's own reading, by stage of the email-borne form described above.
| Stage | ID | Name |
|---|---|---|
| Research: voice sample and org chart | T1593.001, T1591.004 | Search Open Websites/Domains: Social Media; Gather Victim Org Information: Identify Roles |
| Setup email from a lookalike domain or a compromised mailbox | T1583.001, T1586.002, T1598 | Acquire Infrastructure: Domains; Compromise Accounts: Email Accounts; Phishing for Information |
| The cloned call | T1656, T1566.004 | Impersonation; Phishing: Spearphishing Voice |
| Push approval or code read out | T1621 | Multi-Factor Authentication Request Generation |
| Access after approval | T1078 | Valid Accounts |
Wire fraud and bank-detail changes are financial outcomes and have no ATT&CK technique of their own.
Recommendations for defenders
- Treat a request to move a conversation off the thread, to a phone number or chat handle the organization does not hold, as the inbox-visible signal of this attack, and make it a detection in email security and a stop in finance workflows.
- Confirm every payment, bank-detail change and MFA re-enrolment requested by voice or video on a channel the organization already holds, such as a number on file, never one the caller or the email gives. A callback rule needs no new tooling.
- Judge messages with no payload by sender history and request, not only by what they carry: a known display name on a first-time address, a reply-to that differs from the from address, a domain registered this month, and a change of ask inside a trusted vendor thread.
- Give finance and the help desk a path no caller can bypass: ticket-only resets and dual approval on new payees, so no single call reaches a person with the authority to act alone.
- Train for voice and video as well as email. Employee training cut USD 196,259 from the average breach cost in the study; add a cloned-call exercise so the step that closes this attack is rehearsed, and not only the email that opens it.
- Measure time to identify for people-targeted incidents, and alert on a new payee, a bank-detail change or an MFA re-enrolment within hours of a call-request email. Across all breaches in the study, those identified and contained in under 200 days cost USD 1.33 million less than those that ran longer.
FAQ
What is an AI deepfake impersonation attack?
An attack that uses a synthetic voice, video or image of a real person, usually an executive, a vendor contact or an IT staffer, to get an employee to approve a payment, change bank details, share a code or approve a sign-in prompt. In the email-borne form this post describes, the call is arranged by an email that carries no link and no attachment.
What does a deepfake setup email look like?
Ordinary business mail with one request in it: a call, soon, off the thread, often with a new phone number and a reason for secrecy. It comes from a lookalike domain, a free-mail address carrying an executive's display name, or a compromised vendor mailbox replying inside a real thread. It carries no link and no attachment, so the signals are the sender's history, the headers and the request itself.
Can a secure email gateway catch the setup email?
Not by its usual means. There is no link to rewrite and no attachment to sandbox, authentication passes when the sender is a real compromised account or a lookalike domain with its own records, and a domain registered days ago has no reputation yet. Catching it means reading the request and the sender's history, which is what AegisAI classifies.
How common are deepfake impersonation attacks?
In the 2026 Cost of a Data Breach study, deepfake or impersonation attacks were 45% of AI-driven attacks, the largest type ahead of AI-enabled malware (19%) and AI-generated phishing (17%). One in four malicious breaches was AI-driven, a 56% increase on the previous year's study, and phishing was the top initial attack vector for the fourth year.
How much does an AI-driven breach cost?
USD 6.04 million on average for a malicious AI-driven breach of any kind, against USD 5.03 million for a malicious breach without AI. The global average across all 602 breaches in the study was USD 4.99 million, a record, up 12% on the previous year. No per-incident cost for deepfake fraud is published.
Can email security stop a deepfake call?
Not the call itself, which happens outside the mailbox. It can act on the message that arranges the call. A request to move to a call, a new number for a known contact or an urgent confidential payment is a request, and a control that classifies the request can investigate it even when the message has no link and no attachment.
What is the fastest control against deepfake fraud?
A callback rule: any payment, bank-detail change or MFA reset requested by voice or video is confirmed on a number or channel the organization already holds. The study's own recommendation is to shift identity security to continuous, runtime verification rather than a one-time check.
References
- IBM and Ponemon Institute (29 Jul 2026). Cost of a Data Breach Report 2026: The AI tipping point. ibm.com/reports/data-breach
- MITRE ATT&CK. Techniques T1593.001, T1591.004, T1583.001, T1586.002, T1598, T1656, T1566.004, T1621 and T1078. attack.mitre.org
Every email, investigated.
Related posts
More from the AegisAI blog.