Identifying a potential victim (relative of a kidnapee). This is someone who is capable of paying ransom. In the previously mentioned real-life virtual kidnapping case, this would be Mrs. DeStefano.
Identifying a potential virtual kidnapping victim (kidnapee). In the same real-life virtual kidnapping, this would be the 15-year-old daughter.
Creating a story. The more emotionally manipulative the story is, the more impaired a victim’s judgment and critical thinking would be. It is highly likely that a frightened person will behave with more immediacy and less forethought.
Harvesting voice biometrics from the virtual kidnapping victim’s social media posts. Malicious actors can also harvest a movie actor’s voice from a frightening kidnapping movie scene and use deepfake technology to make audio that sounds like the subject has been kidnapped and is saying words from a movie.
Identifying time and logistic elements. Based on social media updates from the virtual kidnapping victim, the malicious actors will launch the scam when the subject is physically away from the ransom victim for a long enough period. This can hinder the ransom victim from quickly verifying if the child is safe, allowing the attack and ransom payment to go through successfully.
Making the call. The attackers may use free voice modulation software to make their voice more scary or menacing. During the call, the attackers will simultaneously run the deepfake audio of the supposed kidnapee to grant credibility to their request for ransom payment.
Initiating post-call activities. These include, but are not limited to, money laundering of the ransom payment, deleting all relevant files, and discarding of the burner phone used.

Apart from money laundering, these steps do not require much knowledge or practical skill. Advertising analytics can extract common behavior elements from large populations and attach expected behaviors to the members of these populations. This target sorting and rating method increases the efficiency of the attack. Much of the work in this attack can be further automated with artificial intelligence tools such as ChatGPT.