A city CISO warns that attackers also use AI, so awareness training must cover deepfake vendor-call scams. What security-awareness lesson fits?

City security awareness must evolve as attackers use AI to produce deepfake vendor-call scams that mimic familiar voices and urgent payment or access requests. The fitting lesson is that staff should verify unusual payment or access requests through known official channels—callback numbers from the vendor master file, finance approval workflows, or established IT ticketing—because voice familiarity alone is no longer reliable proof of identity. Awareness training that centers verification habits reduces successful social engineering against municipal finance and facilities teams. Verifying unusual payment or access requests through caller ID callback procedures is unsafe because displayed numbers can be spoofed, so calling back the displayed number does not provide independent verification through known official channels. Verifying unusual payment or access requests with automated voice authentication screening is not a reliable control because spectral analysis can miss evolving fakes and produce errors, so synthetic-speech flags do not replace verification through known official channels. Verifying unusual payment or access requests via knowledge-based invoice challenge questions is unsafe because attackers can learn stolen amounts or details from prior emails or breaches, so matching details do not confirm vendor familiarity and out-of-band verification is still required. Exam caveat: deepfake quality improves quickly, and internal callers can also be spoofed; policies should cover both external vendors and unusual requests that appear to come from executives or department heads. Operational check: confirm that finance and facilities SOPs require out-of-band verification for payment-detail changes, that staff know where official contact directories live, and that reporting of suspected deepfake attempts is practiced in tabletop exercises.