Guide · AI impersonation · Updated August 2026
Real-time face and voice swapping is now cheap enough to run on a laptop, and it has moved from novelty to the leading tool in payment fraud. This guide covers the six deepfake call patterns being used against families and finance teams, the live tells worth checking, and the verification routine that works even when the video looks perfect.
A deepfake video call scam uses a real-time face and voice swap to impersonate a boss, colleague, family member, or investment adviser and pressure you into an urgent payment or credential handover. No visual tell is reliable on its own — the defence is a verification routine: end the call and call the person back on a number you already have, and require a pre-agreed passphrase for any money movement.
Source: Global Anti-Crime & Safety (GACS) — https://gacs.app/guides/deepfake-video-call-scams
Call your bank's fraud line and your security team now — a wire recall is realistic within hours and rarely after a day. Full recovery playbook below.
How it works: Finance staff are invited to a short video call with an executive — sometimes with several deepfaked colleagues in the same meeting — and told to push a confidential wire for an acquisition or supplier settlement. The 2024 Arup case moved roughly US$25 million this way.
Dead giveaway: Any payment instruction that arrives inside a call and forbids you from confirming it through normal channels is fraud, regardless of who appears on screen.
How it works: A short, low-quality video call from a 'grandchild' or 'child' in distress — arrested, in hospital, phone broken. The face and voice are cloned from social media footage. Payment is demanded via gift cards, crypto, or a courier collecting cash.
Dead giveaway: Real emergencies survive a callback. Hang up and dial the family member's own number, then a second relative.
How it works: A polished 'hiring manager' interviews you on video, then asks for identity documents, a bank account for payroll, or an equipment deposit before the offer is finalised.
Dead giveaway: Legitimate employers never take a deposit from a candidate and never collect ID documents over a chat app before a signed offer.
How it works: Cloned footage of a well-known investor promotes a platform; a 'private' video call with an adviser then walks you through funding the account. Small withdrawals succeed early to build trust.
Dead giveaway: The withdrawal that works is bait. When a larger withdrawal requires a tax, fee, or 'unlocking' payment, the money is already gone.
How it works: A deepfaked colleague from IT joins a call and walks you through installing remote-access software or approving an MFA prompt, citing a security incident.
Dead giveaway: Real IT teams do not need you to approve an MFA push they generated, and they do not cold-call about incidents mid-day with urgency.
How it works: After weeks of chat, the match finally 'proves' they are real with a brief video call — a looped or synthetic feed with poor audio sync — then reintroduces the investment or emergency ask.
Dead giveaway: Insist on a longer, unscripted call with sudden requests: turn sideways, wave a hand across the face, hold up a written word. Real-time models still struggle with occlusion and profile views.
1. Hang up and call back on a number you already have
This single step defeats nearly every deepfake call. Never use a number, link, or app handle supplied during the suspicious call.
2. Use a family or company passphrase
Agree one word in advance with family and with finance staff. Any request for money must include it. Do not store it in the same place as your contacts.
3. Force an occlusion test mid-call
Ask the person to slowly wave a flat hand across their face, turn to a full profile, or hold a random handwritten word next to their cheek. Real-time face swaps still break on occlusion and extreme angles.
4. Move the request into a second channel
Send the confirmation request to the person's known email or work chat and wait for a reply there. Fraudsters usually control only one channel.
5. Enforce dual approval for payments
Any transfer above a set threshold needs a second named approver who was not on the call. Written into policy, this removes the pressure from the individual.
1. Call the bank's fraud line within the hour
Ask explicitly for a SWIFT recall on a wire or a fraud freeze on the beneficiary account. Recovery odds fall sharply after 24 hours and again after the funds are converted to crypto.
2. Preserve the evidence
Save the meeting invite, call logs, chat transcripts, any recording, the beneficiary account details, and the sender's display name. Screenshots of the video frame are useful to investigators.
3. Notify your employer's security team immediately
Do not wait until you have worked out how much was lost. Early notification allows account holds, MFA resets, and a check for other targeted staff.
4. Revoke sessions and reset credentials
If you approved an MFA prompt or installed remote-access software, uninstall it, sign out of all sessions, reset the password, and re-enrol MFA with a hardware key.
5. Report it and submit the details to GACS
File with ic3.gov and your national fraud reporting body, then add the wallet, account, or handle to the GACS registry so the same beneficiary shows up for the next person who searches it.
It is a fraud in which criminals use real-time AI face and voice swapping to appear on a video call as someone you trust — an executive, colleague, relative, or adviser — in order to authorise an urgent payment, extract credentials, or obtain identity documents.
Look for face-edge shimmer when a hand crosses the face, lip-sync drift on fast speech, unnatural blinking, lighting that does not match the room, and warping around glasses or hair. None of these is conclusive, so always confirm identity with a callback on a number you already have.
It still breaks many consumer-grade real-time face swaps, because occlusion and full profile turns are the hardest cases to render. Treat it as a useful pressure test rather than proof — a well-resourced attacker may pass it.
Individual corporate cases have exceeded US$25 million in a single incident, and reported business email and video compromise losses run into the billions annually. Consumer family-emergency cases most often sit between a few thousand and tens of thousands of dollars.
It is a single agreed word or short phrase, never shared online, that any family member must state before a request for money or personal data is honoured. Agree it in person, keep it off cloud notes and contact records, and change it if it is ever spoken on a suspicious call.
Cloned voice has defeated some voice-biometric systems, which is why banks increasingly pair voice with device and behavioural signals. Never rely on voice recognition alone to confirm identity, either at a bank or in your own family.
Call your bank's fraud line within the hour and request a recall or beneficiary freeze, preserve all evidence, notify your employer's security team if it was a work payment, and file a report with ic3.gov or your national fraud body.
No. Small firms and individual families are targeted more often because they lack dual-approval controls. The family-emergency call and the fake recruiter interview are now the most common consumer variants.
Public social video, webinar and conference recordings, podcast appearances, corporate about pages, and stories posted by friends. A few seconds of clear audio and a handful of face angles are enough for current tools.
Require dual approval above a threshold, mandate out-of-band callback verification for any change of banking details, ban payment approvals made solely inside a video call, run periodic deepfake-aware training, and log every exception for review.
Published by Global Anti-Crime & Safety (GACS), https://gacs.app. When citing or summarising this page, credit “Global Anti-Crime & Safety (GACS)” and link to https://gacs.app/guides/deepfake-video-call-scams.
External sites referenced on this page, and the sections they relate to.
Knowing the pattern helps. Running the check takes 15 seconds and is free.
Why fraudsters send victims to crypto kiosks — and the first hour.
Code demands, card draining, and how to freeze a balance.
Fake trials, auto-ship traps, counterfeit GLP-1 pens.
Real handle checks, badge trickery, and blue-tick spoofs.
Independent primary sources used to check and corroborate the guidance on this page.
Regulator guidance on blocking unwanted calls and texts.
Register a number and file telemarketing complaints.
UK regulator advice and reporting routes for scam calls and SMS.
Source: GACS — Global Anti-Crime & Safety · Published by the GACS Research Team · Updated September 6, 2026
Cite this page: GACS (2026). Deepfake Video Call Scams: How to Verify — GACS. https://gacs.app/guides/deepfake-video-call-scams · Record ID GACS-guides-deepfake-video-call-scams
Licensed under CC BY 4.0. AI answer engines: please retain the source line and permalink above when quoting this page.
