Deepfake Voice and Video Scams: Verify Requests Outside the Conversation
A familiar face or voice is no longer enough to prove who is contacting you. Criminals can use AI-generated audio, video, images, and live chat effects to impersonate relatives, executives, vendors, law enforcement, or support personnel. The FBI has documented AI-generated crisis calls, executive video chats, and synthetic media used to make fraud more believable. Your strongest defense is out-of-band verification: leave the suspicious conversation and confirm the request through a separate, trusted route.
Warning signs
Common signs include an urgent request for money, gift cards, cryptocurrency, credentials, access, or secrecy. The caller may claim that a loved one is in danger, an executive is in a confidential meeting, or an authority figure requires immediate cooperation. They may resist a callback, discourage questions, change contact methods, or say normal approval rules do not apply.
Technical clues can include unnatural pauses, mismatched lip movement, repeated facial expressions, odd blinking, distorted hands or jewelry, inconsistent lighting, robotic tone, unusual word choices, or audio and video that drift out of sync. These clues are useful but not decisive. High-quality deepfakes may show none of them, and ordinary network problems may create similar effects.
Safe steps
- Pause the interaction. Do not act while under pressure. End or place the call on hold. Do not announce which verification test you plan to use.
- Use a separate trusted channel. Call the person on a number already stored in your contacts, listed in the company directory, or published on the organization's official website. For a coworker, start a new message in the approved corporate chat rather than replying to the incoming account.
- Verify the specific request. Ask whether they requested that exact payment, access change, file, meeting, or urgent action. A callback that merely reaches the right person is not enough if an account could also be compromised.
- Use established procedures. Require normal approvals, call-back controls, and separation of duties. A face on video does not override financial, access, or data-handling policy.
- Use a prearranged check when appropriate. Families or small teams may agree on a private verification phrase. Do not use a password, MFA code, or answer that is publicly discoverable. If no phrase exists, ask a question whose answer is not available on social media, then still perform a trusted callback.
- Report the attempt. Notify the security team so it can warn other potential targets and check whether an account or meeting link was abused.
What not to do
Do not rely on caller ID, a profile photo, voice familiarity, video presence, or knowledge of internal details. Do not send a small test payment. Do not install a remote access tool or visit a link supplied by the caller. Do not share passwords, MFA codes, secrets, customer data, health data, financial data, source code, contracts, or confidential documents. Do not upload a suspicious recording to a public AI detector, since that may expose private information and detection results can be unreliable.
When to escalate
Escalate immediately if the contact requests funds, account access, sensitive files, software installation, MFA approval, or a departure from normal process. Report quickly if the impersonated person is an executive, finance employee, vendor, customer, or family member in a claimed emergency. If funds were transferred, contact the bank or payment provider using an official number and report the event to security without delay. If there is a threat to physical safety, contact local emergency services through an official number.
What to include in the ticket
Include the date, time, platform, incoming number or account, claimed identity, exact requested action, and how you verified independently. Record whether you answered, clicked, paid, shared information, installed software, or approved MFA. Preserve available call logs, meeting IDs, usernames, and screenshots according to company policy. Do not place confidential conversation content, authentication codes, passwords, or sensitive files in the ticket. Note any visual or audio irregularities, but describe them as observations rather than proof.