For most of the history of fraud, the phone call was the expensive part. It needed a fluent speaker, a plausible accent, a confident manner, a memory for the story so far, and the nerve to hold the line when the target pushed back. Operations hired for it, trained for it, and were limited by it.
That constraint is gone. The caller can now be a superintelligent agent, and the target cannot tell.
What a hyper-humanised agent is
A hyper-humanised agent is a conversational system that presents as a person across voice, face and behaviour at the same time. It speaks with a cloned or synthesised voice. It appears on video with a photorealistic face, natural micro-expressions and lip movement that matches the audio. It watches the target through the camera, reads expression and hesitation, and adapts. It takes turns the way a person does, pausing, interrupting, laughing at the right moment. It responds in well under a second, so there is no tell-tale lag.
The public demonstration of this capability is Tavus, a legitimate platform whose conversational video interface builds a photorealistic replica from roughly two minutes of footage and runs it as a live, perceptive agent for recruiting, tutoring and customer support. Its existence is not the problem. It is the proof that the capability is mature, commercial and cheap, and that the same class of system is now available to an operation whose product is fraud.
Why the call is the top-tier threat
Fraud succeeds on trust, and nothing establishes trust like a face and a voice. People who would delete a suspicious email will act on a video call from someone who looks like their finance director. People who would ignore a text will take instruction from a sympathetic voice that has called them every week for a month.
Superintelligence removed every limit on the call. Any language, any accent, any persona, any number of simultaneous conversations, perfect recall of every prior exchange, and no fatigue. An operation can now run the warm, patient, months-long relationship that was previously reserved for the highest-value targets against anyone at all.
The 2025 FBI IC3 report, the first to carry a dedicated section on artificial intelligence, describes exactly this: cloned executive voices authorising transfers, fabricated video used in business email compromise, romance, employment and investment schemes, and a corporate impersonation category that cost victims $3.04 billion in one year.
Why the average person cannot tell
The honest answer is that there is nothing left for them to notice. The voice does not glitch. The face does not drift. The timing is human. The agent knows the target's name, employer, recent travel and the name of their dog, because all of it was public. When the target asks a hard question, the agent answers it. When the target says they will call back, the number they call back reaches the agent.
Training people to spot the fraud was a reasonable control when fraud was crude. Against a hyper-humanised agent it is asking a person to beat a system built specifically to be indistinguishable from a person. That is not a fair fight, and it is not a control.
What a structural answer looks like
Verify the human, not the appearance. ScreenComply establishes that the person on a screen is physically real, is who they claim to be, and is acting unassisted: not a replica, not an agent, not a person being fed lines. For hiring, for client onboarding, for high-value approvals and for remote work, it replaces "they looked right on the call" with evidence.
Make the channel itself prove its origin. A call or a video session that claims to come from inside the organisation should carry proof that it did. Monolith validates that the identity, the device and the session behind an internal request qualify on a trusted compute layer before the request is honoured, so a convincing voice on an unverified line does not get to authorise a transfer.
Defend the infrastructure the call relies on. Fraudulent calls are backstopped by lookalike domains, spoofed caller identity, cloned websites and planted credentials. Monolith inventories and monitors domains, registrars, DNS, certificates and mail authentication, flags the lookalike the day it is registered, and treats the administrative layer as the perimeter it has become.
Bind approvals to the action. A human approval of a payment, an access grant or a change binds to that specific action; a replayed or altered request needs approval again. The deepfake CFO can ask. The ask does not become money without a second, structural check.
The feature set behind this, including presence tokens, consequential-action holds and reset gating, is described on stopping social engineering at the hardware layer.
Frequently asked questions
What is a hyper-humanised agent?
A superintelligent conversational system that presents as a person across voice, face and behaviour simultaneously: cloned or synthetic voice, photorealistic video with natural expression, perception of the target through the camera, human turn-taking and sub-second response. Commercial platforms such as Tavus demonstrate the capability for legitimate uses; the same capability is now used in fraud.
Can voice cloning be detected by ear?
Not reliably. Current voice synthesis passes casual listening on an ordinary phone line, and in a stressful call the listener is the least reliable detector available. Verification has to be structural, through the identity and channel behind the call, rather than relying on the listener's ear.
How are deepfake calls used against companies?
The most common pattern is a cloned executive or vendor voice, sometimes on video, instructing a finance or operations employee to make or redirect a payment, change bank details, or grant access. The FBI IC3 2025 report records cloned voices authorising transfers as part of $3.04 billion in business email compromise losses.
How does ScreenComply help?
ScreenComply verifies that the human on the other side of a screen is physically real, is the person they claim to be, and is acting unassisted. It is used in hiring, onboarding, high-value approvals and remote sessions, exactly the moments a hyper-humanised agent targets.
What does Monolith do about fraudulent calls?
Monolith defends the layer the call depends on: it validates that internal requests come from attested identities and devices, monitors domains, registrars, DNS and certificates for the lookalike infrastructure fraud needs, and binds human approvals to specific actions so a convincing voice cannot turn a request into a transfer on its own.