Deepfakes are changing the MFA security landscape. A determined bad actor could use traditional methods, such as brute-force attacks, adversary-in-the-middle phishing campaigns or bombarding users with MFA prompts, to gain entry. Or they could simply call the help desk, use an employee's cloned voice and persuade a support agent to reset credentials, remove an existing authenticator or enroll a new device that's under the attackers' control.
MFA is a core control within the broader identity and access management (IAM) framework, which ensures the right people and devices have the appropriate access to systems and data. Identity lifecycle management, part of IAM, governs a digital identity from creation through retirement. These processes reestablish trust, replace lost or stolen authenticators or restore access after disruptions such as a lost or damaged device, account lockout or forgotten credentials.
Let's explore how bad actors use deepfakes to undermine conventional MFA recovery methods, outline a practical framework to fight them and highlight ways in which detection and prevention measures can significantly reduce risk.
Understanding deepfake threats to MFA recovery
Deepfakes have roared onto the scene and threaten the recovery process at the heart of the IAM identity lifecycle. The cost and skills required to produce convincing synthetic voice and video have dropped dramatically, so nearly anyone can impersonate employees during troubleshooting calls to restore access, reset MFA and request additional access.
While calling the help desk and impersonating an employee is the most direct and common path to obtain credentials, deepfakes are used in other ways to make several tactics more effective, including the following:
- Real-time or pre-recorded video used during a verification call to satisfy visual identity checks.
- Executive or manager impersonation that creates urgency and pushes the agent to override normal procedures.
- Combination attacks that pair a deepfake voice or video with knowledge-based details pulled from public sources or prior breaches.
- Targeted recovery of high-privilege accounts, where a successful help desk reset grants broader downstream access.
These deepfakes will continue to succeed as long as the recovery process continues to treat a convincing face, voice or story as sufficient proof of identity. That's why modern MFA recovery frameworks must eliminate this practice and require independent, harder-to-fake evidence before approving any reset or authenticator change.
Creating a secure MFA recovery framework
MFA recovery frameworks must treat recovery as a high-risk process that demands stronger evidence. The core principle behind this framework should be to require evidence that's harder to synthesize than a cloned voice, face or business-relevant pretext as proof of identity.
Start with a two-tiered model. Lower-risk users can retain self-service options that rely on multiple pre-registered authenticators. Higher-privileged users should require stronger proof, such as phishing-resistant MFA, identity confirmation through a separate out-of-band channel or dual approval. Remove or restrict weaker methods, including text-message codes, or voice or video-only verification.
This framework involves strict process discipline, requiring all help desk staff to follow scripted, non-overridable steps that eliminate the urgency and familiarity deepfakes rely on.
Document every recovery action with the appropriate evidence, who the approver was and the resulting outcome or change. When implemented properly, the framework reduces the risk of impersonation without blocking legitimate users from accessing the digital resources they need to perform their roles.
Detection and prevention controls
Practicality is the name of the game when it comes to MFA recovery detection and prevention controls. Liveness detection checks are the most direct counter to today's deepfake video or voice attempts. These tools analyze whether a face or voice is live rather than injected or replayed, which raises the bar that synthetic media must clear to be accepted. Pair these checks with injection protection on any video or biometric verification step to stop most pre-recorded or generated content from entering the recovery process.
Combining technical controls with operational workflows further lowers risk. For example, help desk processes should require clearly documented out-of-band confirmation for high-risk recoveries and prevent agents from overriding controls under pressure.
Additionally, continuously monitor recovery events and alerts, such as unusual device enrollments, multiple reset attempts or recoveries from non-baseline locations, to further improve effectiveness.
Finally, it's best to track core metrics to confirm whether the controls in place are working or whether they need bolstering with additional tools or policies. Useful indicators include the following:
- High-risk recovery verification rate. The percentage of high-risk recoveries completed with independent out-of-band confirmation.
- Recovery anomaly volume. The number of unusual events investigated.
- Unauthorized change reversal time. The average time to detect and reverse an unauthorized authenticator or recovery change.
- Deepfake recovery attempt reduction. The overall percentage decrease -- or increase -- of deepfake-related recovery incidents over a specified time frame.
- Escalation and denial rates. The proportion of high-risk recoveries that are either escalated or denied.
These measures show whether liveness detection, injection protection, process discipline and monitoring close the recovery gap while reducing friction for legitimate users.
The ease of creating deepfakes has turned MFA recovery into a high-risk process that should no longer rely on a convincing voice, face or story. Instead, a two-tiered risk framework, tools, strict processes and monitoring of core metrics offer a practical, lower-risk path forward. CISOs should start by assessing current recovery workflows against this model and prioritize high-privilege accounts first.
Andrew Froehlich is founder of InfraMomentum, an enterprise IT research and analyst firm, and president of West Gate Networks, an IT consulting company. He has been involved in enterprise IT for more than 20 years.
