Real-time deepfake in video calls
A fraudster can take on an executive's face and voice in a video call. What the sources say, and the check that protects you.
In 30 seconds
- Where it happens
- In an electronic exchange where the other party claims to be a trusted person. MITRE describes phishing as social engineering delivered electronically, with impersonation of a trusted source among its techniques1.
- What the attacker wants
- To obtain information, often credentials2. Realistic manipulated faces are the subject of the FaceForensics++ study3. The NCSC adds unauthorised payments4.
- The reflex
- For any important request, check through a second type of communication, a rule the NCSC states for requests received by email4.
- If it has already happened
- Tell the security team right away. The NCSC recommends a clear reporting procedure, with no blame for the person who fell for it4.
What it is
A video call feels like talking to someone you know: you see their face and hear their voice. A fraudster appears as an executive or a colleague to obtain a transfer, some information or access.
This article comes with a limit. The sources gathered for it describe phishing in general and the manipulation of facial images. None of them describes a case of deepfake fraud in a video call. What follows therefore stays within what these sources establish, and the text flags what they do not cover.
Straight answers
Can you spot a deepfake with the naked eye?
The FaceForensics++ study (2019) examines how realistic facial manipulations are and how hard they are to detect, automatically or by humans3. Its authors conclude that their detection method outperforms human observers3. The study does not cover today's live deepfakes. The sources in this file give no list of visible signs on screen. An employee should therefore not base a decision on the impression of having "seen" a flaw, or of having seen none.
Who is targeted?
The NCSC distinguishes public-facing departments, which receive many unsolicited messages, from people with authority to access sensitive information, manage funds or administer systems. The latter are of more interest to an attacker and may face a sophisticated spear-phishing campaign4.
What should you do with a transfer request received in a video call?
Apply the NCSC rule: verify important requests through a second type of communication, such as a text message, a phone call, a login to an account or an in-person confirmation4. The NCSC states it for requests received by email. The principle, a channel independent of the first one, applies equally to a video call, but this extension is a reading of the rule and not a statement from the source.
Should you call back the number the other party gives?
The sources describe the opposite trap. MITRE notes that victims receive messages asking them to call a number, where the attacker tries to collect confidential information2. This article's own inference, which is not in the sources: the number supplied by the person making the request cannot serve as an independent second channel, and a number the company already knows is preferable.
Does an employee who was tricked risk a sanction?
The NCSC advises against reprimanding people who are struggling: those who fear reprisals report their mistakes late, or never. It asks that this message be backed by every department, including human resources and management4.
1Inside the attacker's head1 min
MITRE presents phishing as a way to gain initial access to the victim's systems. It can be targeted at a person, a company or a sector (this is called spear-phishing) or untargeted1. Among the techniques described: posing as a trusted source, spoofing a sender's identity, or inserting oneself into an existing conversation thread1.
One variant aims at information rather than the execution of malicious code. MITRE explains that the attacker then seeks to make the victim disclose credentials or other usable data, and may do so through instant messaging or other electronic conversation channels2. One sub-technique is named "Spearphishing Voice", spear-phishing by voice1.
The NCSC adds that attackers exploit ways of working: they can push someone to hand over information, passwords included, or to make unauthorised payments4. A fake executive in a video call follows the same logic, but no source in the file documents it.
2What you see on screen1 min
The sources establish no reliable visual sign. They only say that facial manipulations such as DeepFakes, Face2Face, FaceSwap and NeuralTextures are realistic enough that a benchmark was built to detect them3. According to the authors, a detector trained on this data outperforms human observers, even when the video is heavily compressed3.
For an employee, the practical consequence is not to rely on visual impression. If a request is unusual, urgent or involves money, verification through another channel is required, whether the image looks perfect or not.
3Under the hoodIT teams1 min
The sources in the file do not describe how live face swapping or voice cloning works. They therefore do not allow writing here about virtual cameras or latency. Two elements are established.
First: FaceForensics++ offers a public benchmark for detecting facial manipulations. It contains a hidden test set and a database of more than 1.8 million manipulated images3.
Second: NIST published a generative AI profile, NIST-AI-600-1, on 26 July 2024. It can help organisations identify the risks specific to this type of AI and proposes actions to manage them5. NIST's general framework is voluntary to use5.
4Case filesReal cases1 min
January 2019: a study examines the detection of manipulated faces
The FaceForensics++ researchers submitted their study on 25 January 20193. They note that progress in image synthesis raises concerns for society. At best, they write, it leads to a loss of trust in digital content3. The study describes no fraud: automatic detection in it outperforms the human eye3.
A phishing case at a financial institution (date not given)
The NCSC describes a real case without giving its date. A financial-sector company of about 4,000 employees received 1,800 emails containing variants of the Dridex malware, presented as an urgent invoice4. The filter stopped 1,750, and 50 reached inboxes4. Of those 50, 36 were ignored or reported, including 25 reported in total, and 14 were opened4. Only one machine was infected, and the malware's call to its operator was detected, reported and blocked4. The machine was seized, examined and cleaned within a few hours4. This case shows the effect of several layers of defence, including reporting by employees. It does not concern video calls.
Fact sheet
- Identifier
- CP-296
- Wing
- 4. Artificial intelligence
- Brain skill
- Detecting Deepfakes & Voice Cloning (deepfake)
- Brain reflex
- air-030
- Diagram
- G4 · Incident Timeline & Containment
- Languages
- de, en, fr
- Sources
- 5 sources checked on 3 November 2026
Sources5 sources
- MITRE ATT&CK, “Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026)
- MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
- arXiv, “FaceForensics++: Learning to Detect Manipulated Facial Images”, 25 January 2019. https://arxiv.org/abs/1901.08971 (accessed 3 November 2026)
- NCSC (Royaume-Uni), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)
- NIST, “AI Risk Management Framework”. https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026)
Cite this article
Brain, “Real-time deepfake in video calls”, Cyberpedia, 2026. https:/
BibTeX
@misc{brain_cp296_en_2026,
author = {Brain},
title = {Real-time deepfake in video calls},
year = {2026},
howpublished = {Cyberpedia},
url = {https://startbrain.io/cyberpedia/en/articles/real-time-deepfake-video-calls/},
note = {CC BY 4.0}
}