Run a deepfake fire drill in 10 minutes

Two real cases show why a drill is worth 10 minutes of your next meeting.

In early 2024, a finance worker at engineering firm Arup in Hong Kong joined a video call with people he believed were the company's CFO and colleagues. All of them were deepfakes. He sent HK$200 million (about US$25.6 million) across 15 transactions, according to CNN, even though he had first suspected the request because it asked for a secret transaction.

In July 2024, a Ferrari executive received WhatsApp messages and then a call from someone using a cloned version of CEO Benedetto Vigna's voice, pushing an urgent, confidential deal. The executive asked about a book Vigna had recently recommended. The caller hung up. The case was reported by Bloomberg and Automotive News and is logged by the OECD's AI incident monitor; Bloomberg's report, republished by Fortune, covers the details.

The difference between the two outcomes wasn't a better ear for fakes. It was a check that someone felt able to use under pressure. A fire drill exists to rehearse exactly that. U.S. agencies including the NSA, FBI and CISA have urged organizations to prepare for, defend against and respond to deepfake threats, and the UK National Cyber Security Centre offers free exercises organizations can run themselves with no cyber expertise needed.

What you need

• 10 minutes at the start of a meeting you already have

• One person to facilitate

• One scenario, read aloud (below)

• A timer and somewhere to write down what you agree

You don't need an actual deepfake. Describe the call in words and have someone read the lines. Never clone a real colleague's voice or face for practice, and always tell people it's a drill before it starts. Surprise tests on colleagues damage trust, and trust is the thing you are building.

Roles

• Facilitator. Keeps time, reads the frame, runs the debrief.

• Caller. Reads the scenario lines as the fake sender. Use a role ("the managing director") rather than a real colleague's name.

• Responder. A volunteer who talks through what they would do. Ideally, a leader goes first.

• Everyone else. Listens for the moment they would have paused and notes any verification step they'd suggest.

Pick a scenario

Choose one per drill and rotate them over time.

1. The Friday payment. At 4:45 p.m. on a Friday, the responder gets a voice note on a messaging app from "the managing director." There's a confidential acquisition. A new supplier must be paid before Monday. Finance shouldn't hear about it yet, and the managing director is about to board a flight.

2. The helpful IT desk. After a morning of inbox floods, a Teams call arrives from "IT support" offering to fix it. They ask the responder to install a remote-access tool and read out the code that just arrived on their phone. Microsoft named email bombing, often followed by a fake IT support call, one of 2025's most effective social engineering tactics.

3. The family call. For a session about home life: a call from a crying grandchild who has been in an accident and needs money for bail right now, and please don't tell their parents. The FTC describes this family emergency scheme and how voice cloning makes it more convincing.

Give the caller two pressure lines to use if the responder hesitates, for example "I really don't have time for this" and "I thought I could trust you with this."

The 10-minute run sheet

1. Minute 0 to 1: set the frame. The facilitator says: "This is practice. There are no wrong answers. We're testing our process, not people."

2. Minutes 1 to 4: run the scenario. The caller reads the opening. The responder says out loud what they'd do. The caller uses the pressure lines once each.

3. Minutes 4 to 8: debrief. Use the questions below. Let the whole room answer as well as the responder.

4. Minutes 8 to 10: agree one change. One concrete improvement, one owner, one date.

Debrief questions

Pick four or five. You won't get to all of them, and that's fine.

• At what moment did something feel off? What exactly triggered it?

• What would you actually do next, step by step?

• Which number would you call to check? Could you find it in 30 seconds without using anything in the message?

• Who could you ask for a second opinion right now?

• Would you feel comfortable calling the managing director to verify? What would make that easier?

• Is there a question or code word only the real person would know?

• If someone had already paid, who is the first call: the bank, finance, IT?

• What one rule would have made this an easy decision?

The answers usually point to the same few fixes: a call-back rule on a known number, a written list of who to contact, a code word for urgent payment requests and leaders who say plainly that they want to be checked. The FBI recommends families use a secret word or phrase to confirm identity, and the same idea works for teams.

Keep it blame-free

The drill only works if people feel safe saying "I would have paid." The NCSC's culture guidance says incidents should be investigated to learn and improve, that people shouldn't be punished for innocent mistakes and that without that safety people tend to cover mistakes up. Its phishing guidance makes the same point about reporting: people who fear reprisals won't report mistakes promptly.

In practice:

• Use volunteers only, and have a leader take the first turn.

• Praise good questions and good instincts, not "catching" the fake.

• Don't score individuals or share who said what outside the room.

• If someone says they would have fallen for it, thank them. That's the most useful answer in the drill, because it shows where the process needs help.

• Finish by repeating the change you agreed.

Make it a habit

One drill helps. A short drill every month or quarter, with a new scenario each time, turns the check into muscle memory. Keep a running list of the changes you've agreed and look at it at the start of the next drill. When a real request arrives, the pause will feel normal rather than rude.

Sources

• CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim," May 16, 2024: cnn.com

• OECD.AI, "Ferrari Executive Thwarts Deepfake Scam Attempt" (AI incident monitor), July 2024: oecd.ai

• Bloomberg via Fortune, "Ferrari exec foils deepfake attempt by asking the scammer a question only CEO Benedetto Vigna could answer," July 27, 2024: fortune.com

• CISA, "NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats," Sept. 12, 2023: cisa.gov

• UK National Cyber Security Centre, "Exercise in a Box," undated: ncsc.gov.uk

• Microsoft, "Microsoft Digital Defense Report 2025," Oct. 16, 2025: microsoft.com

• Federal Trade Commission, "Scammers use AI to enhance their family emergency schemes," March 20, 2023: consumer.ftc.gov

• FBI Internet Crime Complaint Center, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud," Dec. 3, 2024: ic3.gov

• UK National Cyber Security Centre, "Principle 2. Build the safety, trust and processes to encourage openness around security," June 4, 2025: ncsc.gov.uk

• UK National Cyber Security Centre, "Phishing attacks: defending your organisation," reviewed Feb. 13, 2024: ncsc.gov.uk

Or let NimBot handle it

A drill is easier to keep up when someone else remembers to schedule it. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.