--- id: CP-168 slug: arup-deepfake-video-call lang: en title: The deepfake video call description: "What the sources say about AI-assisted impersonation of an executive by call or message: what the employee sees, the mechanism, the controls." canonical_url: https://startbrain.io/cyberpedia/en/articles/arup-deepfake-video-call/ markdown_url: https://startbrain.io/cyberpedia/en/articles/arup-deepfake-video-call.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "The deepfake video call", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/arup-deepfake-video-call/ (CC BY 4.0) wing: 2 theme: deepfake reflex: air-032 schema: G4 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/arup-deepfake-video-call/ fr: https://startbrain.io/cyberpedia/fr/articles/arup-deepfake-visioconference/ de: https://startbrain.io/cyberpedia/de/articles/arup-deepfake-videokonferenz/ es: https://startbrain.io/cyberpedia/es/articles/arup-deepfake-videoconferencia/ sources: - "n": 1 title: The near-term impact of AI on the cyber threat publisher: NCSC (UK) url: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat published: "2024-01-24" accessed: "2026-11-03" - "n": 2 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" - "n": 3 title: "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/004/ accessed: "2026-11-03" - "n": 4 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 5 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" --- # The deepfake video call A video call is often taken as proof: you see the faces, you hear the voices, so the people must be there. This page gathers what the sources say about the impersonation of a trusted contact and about generative AI, which produces text, images or video [1]. It draws one principle from them: a payment order should never rest on an online meeting alone. The set of sources gathered for this page does not document the facts of a specific case: none of its pages mentions a deepfake video call case, a victim company or an amount. The page therefore sticks to what these sources establish about the mechanism, and the figures of a particular case do not appear in it. ## In 30 seconds - Where it happens: in a message, a call or an online meeting where a contact presents themselves as an executive or a trusted colleague. - What the attacker wants: to get access [3] or information [4] from the victim, by posing as a reliable source and creating an impression of urgency [3]. - The reflex: before any action requested in a video call, call the person back on a number you already know and have a second person validate the operation. - If it has already happened: tell the security team and the finance team right away, without waiting to check on your own. ## Straight answers ### Can you trust a face and a voice in a video call? The UK's NCSC defines generative AI as AI able to produce text, images or video [1]. It assesses that, through 2025, these tools will make it difficult for everyone, whatever their level of cyber security knowledge, to judge whether an email or a password reset request is genuine, or to spot a phishing, spoofing or social engineering attempt [1]. The sources in the set say nothing about how reliable a face or a voice is in a video call. ### Why are phishing messages harder to spot? The NCSC writes that generative AI already allows convincing exchanges with victims, without the translation, spelling or grammar mistakes that often give phishing away [1]. ### Who can use these techniques? The NCSC states that all types of threat actors, state and non-state, skilled and less skilled, are already using AI to varying degrees [1]. It adds that publicly available models largely remove the need to build one's own technology, notably in low-sophistication operations such as spear-phishing [1]. ### What should you do if an "executive" asks for an action during a call? Do not act during the call. MITRE recommends training users to identify and report social engineering techniques, and to be wary of callers by verifying their identity [3]. ## Inside the attacker's head MITRE describes phishing as social engineering delivered by electronic means. When it targets a specific person, company or sector, it is called spear-phishing [2]. The voice variant uses a call or another form of spoken communication to get the user to give access to systems [3]. Spear-phishing often relies on two levers: posing as a trusted source and creating a sense of urgency or alarm in the target [3]. For information gathering, MITRE also notes the sending of several messages that look urgent [4]. The NCSC places the main gain of AI for attackers in social engineering [1]. It also assesses that AI improves reconnaissance, meaning the search for information about a target to find a way in, and makes this step and social engineering more effective and harder to detect [1]. ## What you see on screen The case described here is a scenario without a source. A message arrives, signed by a superior, and proposes an online meeting. On screen, the participants look like colleagues you know and speak like them. The request is pressing and confidential: a payment to start without delay. MITRE lists urgency among the attacker's levers [3]. The NCSC warns that language mistakes, long used to recognise a fake, are no longer enough [1]. ```text Illustration (fictional message, neutralised): [A "director" asks you to join a confidential meeting urgently via hxxps://reunion-exemple[.]invalid/salle-12 and announces that a payment must be processed today.] ``` ## Under the hood The sources make it possible to name the following elements. - The first contact is a phishing message. MITRE specifies that it can go through email, through third-party services such as social networks, or through calendar invitations [2]. - Identity spoofing is used to make the sender credible: MITRE cites spoofing of the sender's address, which can fool the person as well as automated security tools [2]. - The reconnaissance phase prepares the target. MITRE classes phishing for information under the reconnaissance tactic, with the aim of collecting data rather than executing malicious code [4]. - Generative AI can produce text, images or video [1]. - MITRE cites, among the levers of spear-phishing, the simulated trusted source and urgency [3]. The NCSC assesses that the most sophisticated uses of AI will remain limited to actors with access to quality training data, expertise and resources [1]. It adds that the spread of these capabilities on criminal markets will put them within reach of anyone willing to pay [1]. On the defence side, NIST has published a voluntary AI risk management framework, released on 26 January 2023, then, on 26 July 2024, a profile devoted to generative AI that helps organisations identify the risks specific to generative AI [5]. ## Case files ### Scattered Spider: fake IT staff on the phone MITRE states that, during campaign C0027, the Scattered Spider group posed as legitimate IT staff on the phone. It thereby directed its victims to download a remote administration tool that let it control their machine [3]. The page gives no date for this campaign. It does, however, show the pattern shared with a faked video call: a trusted voice asking for an action. ### Storm-1811: fake tech support According to MITRE, Storm-1811 made calls posing as IT support, to get users to download and run scripts and other tools [3]. The page's references include a Microsoft Threat Intelligence report dated 15 May 2024 [3]. ### The control that matters MITRE recommends, for this technique, verifying the caller's identity [3]. For a payment, this amounts to calling the person back on a channel you already know and executing nothing on the strength of an online meeting alone. Dual approval of transfers is an organisational measure that management puts in place. The sources in the set do not describe it. ## Sources 1. NCSC (UK), "The near-term impact of AI on the cyber threat", 24 January 2024. https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 5. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/arup-deepfake-video-call/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.