CompTIA Security+ (SY0-701)Threats, Vulnerabilities, and MitigationsHard
A CFO receives a phone call from someone claiming to be the company's CEO, urgently requesting an immediate wire transfer to a new vendor account to close a confidential acquisition. The caller's voice closely resembles the CEO's, and the request pressures the CFO to bypass normal approval procedures. Which combination of threat vector and technique best describes this attack?
- AVishing using AI-generated voice deepfake technology
- BSmishing using a spoofed SMS gateway
- CWhaling via a spear-phishing email attachment
- DBusiness email compromise using a typosquatted domain
Show answer & explanationAnswer & explanation
Correct answer: A. Vishing using AI-generated voice deepfake technology
Vishing (voice phishing) is a phone-based social engineering technique, and the realistic voice resemblance strongly suggests the use of AI-generated deepfake audio to impersonate the CEO. This combination of a phone call plus voice cloning is increasingly used in executive impersonation fraud to pressure victims into urgent financial actions.
Why the other options are wrong
- B. Smishing uses text messages, but the attack here is a voice phone call, not SMS.
- C. Whaling targets executives via email, but no email or attachment is described here.
- D. BEC using a spoofed domain involves email communication, not a phone call with cloned voice.
Vishing (Voice Phishing)
A social engineering attack conducted over phone calls, increasingly enhanced with AI voice-cloning (deepfake) technology to impersonate trusted individuals.
- Uses urgency and authority to pressure victims
- AI deepfakes can convincingly mimic real voices
- Common target: finance staff for fraudulent wire transfers
Memory trick: Vishing = voice + phishing; deepfakes make the lie sound like the boss.