• Deepfake video calls are real and cheap. Live AI face swaps on Zoom or Teams can impersonate executives, colleagues, or job candidates.
• Seeing isn’t verifying. Treat a familiar face on video like caller ID. It’s a clue, never proof of identity.
• Process beats deepfakes. Callbacks to known numbers, two-approver rules, and fast reporting stop deepfake fraud.

Previously, in the two part series,  "The CEO Called. It Wasn't the CEO," we learned that a familiar voice on the phone isn’t proof of identity. Now attackers are faking whole video calls.

Dana, her colleagues, and Northfield Logistics are fictional. The cases, groups, and government alerts described are real, with sources linked and listed at the end.

What this is, why it matters, and why you should care

What it is. A deepfake is video or audio that AI has generated or altered so a real person appears to say or do something they never did. This article is about the video kind, now good enough to run live on a Teams or Zoom call.

Why it matters. It is cheap, it is easy, and it is already in use. Researchers at Palo Alto Networks’ Unit 42 reported that people with no prior experience built a real-time deepfake in about an hour using free tools and ordinary hardware. On July 31, 2026, eleven governments, including the US, UK, and Japan, issued a joint alert that lists video feeds that “appear to be manipulated or artificially generated” as a warning sign in remote hiring.

Why you should care. You do not have to be an executive. If you can approve a payment, change bank details, grant access, interview a candidate, or simply attend meetings with people you have never met in person, you are the target. Attackers are hacking the one step that still says, “Well, I saw them on video.”

Dana’s Tuesday (a fictional story)

Dana Reyes has been an accounts payable analyst at Northfield Logistics for nine years. She can spot a duplicate invoice from across the room. Northfield’s payment rules are simple and a little boring: new bank details get a callback to the number already on file, and large wires need two approvers. Dana has never needed a heroic moment, only the rules.

4:42 p.m. The message

A message pings from an app the CFO, Elaine, has never used with her: “Dana, I need your help with a confidential acquisition payment. Call at 5? Please keep this between us.” Dana’s eyebrow performs a small, professional lift. Secrecy, urgency, and a brand-new channel make a famous trio. But Elaine is the CFO, so Dana replies, “Happy to help. Can we do it on video?” An invite lands in two minutes. Very tidy.

5:00 p.m. The meeting

Six squares fill her screen: Elaine, Raj from Treasury, outside counsel, a rep from the partner bank, and Priya from Legal and Tom from Compliance, who say nothing and nod beautifully. Everyone greets Dana by first name. Elaine explains: $1.8 million, new account, today, no time for the usual forms, and Raj has approved it. Counsel calls it “completely standard.” Dana feels the warm tide of consensus: six senior people, zero objections, one clock reading 5:14.

Small things itch. Elaine’s video is a little stiff, and whenever Dana asks a specific question, somebody’s audio drops. But glitches are also what a normal Tuesday looks like, so Dana does not try to out-squint a computer. She says, “Thanks, all. I’ll run this through the standard wire approval and call Elaine back on her main line once it’s logged.” Elaine, a notch cooler, says the delay could cost them the deal. “Understood,” says Dana. “I’d rather be annoying than famous.” She leaves the meeting.

5:21 p.m. The callback

Dana dials Elaine’s number from the company directory. Elaine answers from the sideline of her kid’s soccer game: “What call?” Dana screenshots the invite for the security team. Marcus from IT replies within minutes: keep the invite, do not click anything else. (He later finds the meeting link pointed to a lookalike site, not Northfield’s meeting system.) Procedure would have stopped the wire anyway: a new bank account triggers a vendor-change hold, and a payment that size needs a second approver who had never heard of this deal.

How a video call gets faked

The toolkit is small. Face swapping places one person’s face over another’s and keeps it tracking as they move. Lip-syncing matches mouth movements to words never spoken. Voice cloning is an AI copy of someone’s voice, sometimes built from a short clip. The crucial upgrade is real time: the swap runs live, so a stranger can sit in front of a webcam and appear, on your screen, as someone else, answering questions as they come. Criminals also mix in ordinary material: recorded clips of a real executive, a borrowed profile photo, a fake chat account. It is community theater with a better wardrobe department.

And why a whole room of fakes? Psychologists call it social proof: we judge what is trustworthy by watching what others do. One caller claiming to be the CEO invites doubt. Six familiar faces nodding along feels like consensus, and an attacker who controls the room manufactures it.

Where deepfake video has actually shown up

1. The boardroom ambush: Singapore, March 2025

A finance director at a multinational firm in Singapore was messaged on WhatsApp by someone posing as the company’s CFO, then invited to a Zoom call with the CEO “and others,” all impersonated with deepfake technology, according to the Singapore Police Force. Note the urgency move: the call was suddenly rescheduled to that same day. The director then sent over US$499,000. The scam collapsed when the “CFO” asked for another US$1.4 million. Singapore and Hong Kong police acted within days and withheld the full amount. Moral: speed of reporting turned a loss into a recovery. (For the better-known Arup case, see our earlier vishing article.)

2. The job interview: North Korea’s fake candidates

Two terms first. An APT (Advanced Persistent Threat) is a well-funded, usually government-linked group running patient, targeted operations; vendors name them independently, so one group can have several names. MITRE ATT&CK is a free public encyclopedia of attacker behavior with a page for each known group; it records documented use, not necessarily this week’s activity, so we flag what is current.

This is current. North Korea runs a large scheme in which IT workers pose as foreign nationals to get remote jobs at Western companies. Microsoft tracks it as Jasper Sleet. Unit 42 documented the “logical evolution”: real-time deepfakes in video interviews, letting one operator appear as several different candidates. The July 2026 government alert lists manipulated video, photo-ID mismatches, and refusing to appear on video as indicators. The lesson for any hiring manager: an interview is not an identity check.

3. The fake meeting as a trap: BlueNoroff

Here the fake video call is bait for malware. BlueNoroff, tracked by MITRE as APT38 (G0082) and known as a North Korean state-sponsored group focused on financial theft, ran a campaign (Arctic Wolf, April 2026) against more than 100 cryptocurrency organizations in over 20 countries. Victims joined a fake Zoom or Teams meeting on a typosquatted domain (a lookalike address with a tiny misspelling), and the page quietly captured their live camera feeds to reuse as lures, so every victim became an unwitting cast member for the next. The “audio problem” fix was a ClickFix prompt: a request to run a command “to repair” the call, which installs malware. Mandiant reported a similar pattern (February 2026), including a victim’s report of an apparent deepfake CEO that Mandiant could not independently verify.

Deepfake video also shows up in consumer fraud: the FBI warns that criminals use AI-generated videos of public figures to lend credibility to investment schemes.

Can’t you just spot the glitches?

Sometimes. Live face swaps can struggle when a hand passes over the face, when the head turns sharply, or when the lighting suddenly changes, and Unit 42 suggests interviewers ask candidates for exactly those movements. A fine bonus check. But genuine colleagues on bad hotel Wi-Fi can look like characters in a malfunctioning video game, and the fakes keep improving, so a glitch test is never a security control. The better question is not “Does this person look real?” but “Have I independently confirmed this person is authorized to ask this?”

Five habits that defeat the illusion

1. Verify money, access, and identity changes independently. Confirm new bank details or payment changes using contact details you already had (the directory, an earlier invoice), never a number or link offered during the call. For new hires and vendors, add a second identity check beyond the video.

2. Keep unusual requests unusual. Secrecy, urgency, a rescheduled-to-today call, a new channel, and “skip the usual forms” are the warning label. A convincing meeting does not remove it.

3. Let the process say no. Two approvers, vendor-change holds, and no verbal-only approvals mean nobody has to win an argument with a convincing impostor.

4. Never run a “fix” during a meeting. If a call suddenly needs you to paste a command, install an update, or download a plug-in to “restore audio,” leave the meeting and tell IT.

5. Report suspicious meetings fast. Keep the invitation and messages, do not forward confidential details to “investigate,” and tell IT or security right away. In Singapore, fast reporting got the money back.

The lesson

Criminals no longer have to persuade you to ignore what your eyes and ears tell you. They can manipulate what your eyes and ears receive. That does not mean distrusting every colleague, only no longer mistaking familiarity for verification.

A video call can help people communicate. It should not, by itself, establish identity or authorize a payment.

And if six senior executives suddenly insist that you skip the payment procedure, the most sensible person in that meeting is the one saying, “I’ll call you back.” Dana’s callback took forty seconds. It remains the best-performing security control Northfield owns.

Stay tuned for Part One of our two-part series on how AI is changing security, starting with the attacker’s playbook