[ RECORD YEAR ]2024

WPP CEO Voice-Clone Impersonation Attempt & FBI Warning on AI-Enabled Vishing

In May 2024, WPP chief executive Mark Read disclosed that fraudsters had used a voice clone and YouTube footage of him in a Microsoft Teams meeting, set up via a WhatsApp account bearing his photo, to try to get an agency leader to set up a new business and hand over money and personal details; the attempt failed. On 8 May 2024 the FBI San Francisco field office warned of escalating AI-enabled phishing and voice/video cloning scams.

THREAT SEVERITY
8.0 / 10
Target TechnologyAI Voice Cloning, Microsoft Teams Meeting Impersonation, WhatsApp Pretexting, Voice/VoIP Vishing
OSI Network LayerLayer 7 / Human & Application (Voice / Video Collaboration)
Threat Actor / AttributionUnidentified Fraudsters (Executive Impersonation)
Protocol StandardN/A — Social Engineering over Microsoft Teams, WhatsApp and Voice Calls

02Deep-Dive Technical Analysis

The attackers created a WhatsApp account using a publicly available photo of Read and used it to arrange a Teams meeting that appeared to include Read and another senior WPP executive. During the call they played a cloned voice and recycled YouTube video, while impersonating Read off-camera through the meeting chat. Current voice-cloning tools need only short samples of public speech — earnings calls, interviews, conference talks — to produce convincing audio that can be delivered over collaboration apps, VoIP or ordinary phone calls. The FBI warning described criminals using AI both to craft targeted phishing messages and to clone the voices and likenesses of trusted contacts and executives.

03Vulnerability & Exploit Flow

Exploit Vector

Synthetic voice and recycled video of a real executive used to lend credibility to a pretext delivered over messaging, collaboration and voice channels.

04Recommended Defense & Mitigation Protocol

Operator Hardening Strategy

Require out-of-band verification and multi-person approval for payment or account requests, use phishing-resistant MFA (FIDO2) for help-desk and account-recovery flows, and train staff on deepfake-enabled pretexts.

05Security Impact & Geopolitical Consequence

Became a widely cited example of AI-assisted executive impersonation aimed at a FTSE 100 company, reinforcing guidance from the FBI and others that voice or video alone must never authorize payments or account changes and that out-of-band verification is essential.

06Authoritative Standards & External References

07Related Topic Cluster Records

TelcoSec Global Ecosystem · Academy & Enterprise Audits

Master 5G Core, SS7 Defense & Subsea Cable Auditing

Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.

›Hands-on SS7, Diameter & 5G SBA Firewall Defense
›5G SA Zero Trust Security Architecture & ProLabs
›Enterprise Carrier Auditing & Rogue Base Station Interception
Explore SaaS Academy Labs?Enterprise Consultancy (telco-sec.com)?
SaaS Academy free tier · Enterprise audits for operators