A school-district SOC prepares principals for a vishing campaign that impersonates the superintendent by phone. Which deepfake modality most closely matches that channel?

Vishing against school-district principals is a telephone-channel social-engineering problem, so the deepfake modality that maps most closely is audio voice cloning used in live or recorded calls. Speech-synthesis and clone tooling can reproduce a superintendent's timbre, pacing, and phrasing well enough that a stressed principal may follow urgent instructions without seeing a face. Matching modality to channel is the analytical point: phone and voicemail are audio paths, and civic SOCs should brief principals on voice-clone risk alongside callback and challenge procedures on known-good numbers.

Full talking-head video deepfakes distributed on social media are a different modality and delivery path; they can support reputation or mass-messaging attacks but do not themselves deliver the live phone impersonation described. Still-image face swaps on forged badge PDFs address document or identity imagery, not a call channel. GAN-generated landscape photos for campus brochure phishing are image synthesis used in visual lure content and are unrelated to superintendent voice impersonation over the phone.

Exam caveat: do not conflate 'deepfake' with 'video only.' Many exam items pair deepfake risk with the correct channel; vishing implies audio, even when video deepfakes are popular distractors.

Operational check for school-district SOCs: publish phone verification playbooks for principals; require out-of-band confirmation for urgent access, payment, or policy instructions that arrive by voice; and run authorized awareness drills that emphasize challenge phrases without harvesting or publishing real superintendent clones outside approved ranges.