--- id: CP-296 slug: real-time-deepfake-video-calls lang: en title: Real-time deepfake in video calls description: A fraudster can take on an executive's face and voice in a video call. What the sources say, and the check that protects you. canonical_url: https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls/ markdown_url: https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Real-time deepfake in video calls", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls/ (CC BY 4.0) wing: 4 theme: deepfake reflex: air-030 schema: G4 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls/ fr: https://startbrain.io/cyberpedia/fr/articles/deepfake-temps-reel-visioconference/ de: https://startbrain.io/cyberpedia/de/articles/echtzeit-deepfake-videokonferenz/ es: https://startbrain.io/cyberpedia/es/articles/deepfake-tiempo-real-videollamadas/ sources: - "n": 1 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" - "n": 2 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 3 title: "FaceForensics++: Learning to Detect Manipulated Facial Images" publisher: arXiv url: https://arxiv.org/abs/1901.08971 published: "2019-01-25" accessed: "2026-11-03" - "n": 4 title: "Phishing attacks: defending your organisation" publisher: NCSC (Royaume-Uni) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" - "n": 5 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" --- # Real-time deepfake in video calls A video call feels like talking to someone you know: you see their face and hear their voice. A fraudster appears as an executive or a colleague to obtain a transfer, some information or access. This article comes with a limit. The sources gathered for it describe phishing in general and the manipulation of facial images. None of them describes a case of deepfake fraud in a video call. What follows therefore stays within what these sources establish, and the text flags what they do not cover. ## In 30 seconds - Where it happens: in an electronic exchange where the other party claims to be a trusted person. MITRE describes phishing as social engineering delivered electronically, with impersonation of a trusted source among its techniques [1]. - What the attacker wants: to obtain information, often credentials [2]. Realistic manipulated faces are the subject of the FaceForensics++ study [3]. The NCSC adds unauthorised payments [4]. - The reflex: for any important request, check through a second type of communication, a rule the NCSC states for requests received by email [4]. - If it has already happened: tell the security team right away. The NCSC recommends a clear reporting procedure, with no blame for the person who fell for it [4]. ## Straight answers ### Can you spot a deepfake with the naked eye? The FaceForensics++ study (2019) examines how realistic facial manipulations are and how hard they are to detect, automatically or by humans [3]. Its authors conclude that their detection method outperforms human observers [3]. The study does not cover today's live deepfakes. The sources in this file give no list of visible signs on screen. An employee should therefore not base a decision on the impression of having "seen" a flaw, or of having seen none. ### Who is targeted? The NCSC distinguishes public-facing departments, which receive many unsolicited messages, from people with authority to access sensitive information, manage funds or administer systems. The latter are of more interest to an attacker and may face a sophisticated spear-phishing campaign [4]. ### What should you do with a transfer request received in a video call? Apply the NCSC rule: verify important requests through a second type of communication, such as a text message, a phone call, a login to an account or an in-person confirmation [4]. The NCSC states it for requests received by email. The principle, a channel independent of the first one, applies equally to a video call, but this extension is a reading of the rule and not a statement from the source. ### Should you call back the number the other party gives? The sources describe the opposite trap. MITRE notes that victims receive messages asking them to call a number, where the attacker tries to collect confidential information [2]. This article's own inference, which is not in the sources: the number supplied by the person making the request cannot serve as an independent second channel, and a number the company already knows is preferable. ### Does an employee who was tricked risk a sanction? The NCSC advises against reprimanding people who are struggling: those who fear reprisals report their mistakes late, or never. It asks that this message be backed by every department, including human resources and management [4]. ## Inside the attacker's head MITRE presents phishing as a way to gain initial access to the victim's systems. It can be targeted at a person, a company or a sector (this is called spear-phishing) or untargeted [1]. Among the techniques described: posing as a trusted source, spoofing a sender's identity, or inserting oneself into an existing conversation thread [1]. One variant aims at information rather than the execution of malicious code. MITRE explains that the attacker then seeks to make the victim disclose credentials or other usable data, and may do so through instant messaging or other electronic conversation channels [2]. One sub-technique is named "Spearphishing Voice", spear-phishing by voice [1]. The NCSC adds that attackers exploit ways of working: they can push someone to hand over information, passwords included, or to make unauthorised payments [4]. A fake executive in a video call follows the same logic, but no source in the file documents it. ## What you see on screen The sources establish no reliable visual sign. They only say that facial manipulations such as DeepFakes, Face2Face, FaceSwap and NeuralTextures are realistic enough that a benchmark was built to detect them [3]. According to the authors, a detector trained on this data outperforms human observers, even when the video is heavily compressed [3]. For an employee, the practical consequence is not to rely on visual impression. If a request is unusual, urgent or involves money, verification through another channel is required, whether the image looks perfect or not. ## Under the hood The sources in the file do not describe how live face swapping or voice cloning works. They therefore do not allow writing here about virtual cameras or latency. Two elements are established. First: FaceForensics++ offers a public benchmark for detecting facial manipulations. It contains a hidden test set and a database of more than 1.8 million manipulated images [3]. Second: NIST published a generative AI profile, NIST-AI-600-1, on 26 July 2024. It can help organisations identify the risks specific to this type of AI and proposes actions to manage them [5]. NIST's general framework is voluntary to use [5]. ## Case files ### January 2019: a study examines the detection of manipulated faces The FaceForensics++ researchers submitted their study on 25 January 2019 [3]. They note that progress in image synthesis raises concerns for society. At best, they write, it leads to a loss of trust in digital content [3]. The study describes no fraud: automatic detection in it outperforms the human eye [3]. ### A phishing case at a financial institution (date not given) The NCSC describes a real case without giving its date. A financial-sector company of about 4,000 employees received 1,800 emails containing variants of the Dridex malware, presented as an urgent invoice [4]. The filter stopped 1,750, and 50 reached inboxes [4]. Of those 50, 36 were ignored or reported, including 25 reported in total, and 14 were opened [4]. Only one machine was infected, and the malware's call to its operator was detected, reported and blocked [4]. The machine was seized, examined and cleaned within a few hours [4]. This case shows the effect of several layers of defence, including reporting by employees. It does not concern video calls. ## Sources 1. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 3. arXiv, "FaceForensics++: Learning to Detect Manipulated Facial Images", 25 January 2019. https://arxiv.org/abs/1901.08971 (accessed 3 November 2026) 4. NCSC (Royaume-Uni), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) 5. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.