UBI

Deepfake Video Call Scams: How to Verify Who You're Talking To

By Marko, founder of UBI · October 22, 2026

By Marko, founder of UBI · Published October 22, 2026 · Last reviewed October 22, 2026

A convincing face on a video call doesn't prove who's asking. It certainly doesn't prove they're allowed to ask. If someone on a call wants you to send money, share a password, or hand over sensitive data, treat the request as unverified until you confirm it another way. Pause, contact the person using details you already trust, and confirm the specific request through your normal approval process. You don't need to prove the video is fake before you say no.

Here's the short version. Then we'll get into why it matters.

How to Verify a Suspicious Video Call

If you're facing a strange request right now, work through these six steps in order.

  1. Pause the requested action. Don't transfer money, share sensitive information, or grant access while you check.
  2. Contact the person independently. Use a phone number or directory you already had before this call. Don't use any number, link, or email given to you during the call.
  3. Verify the specific request. Confirm the amount, the recipient, the bank details, the purpose, or the exact access being requested.
  4. Apply your approval policy. Above your chosen threshold, a second person, contacted independently, has to approve.
  5. Escalate anything unresolved. Urgency, secrecy, or pushback against checking should make you more careful, not less.
  6. Record the approval through your normal workflow. A successful callback confirms the request. It doesn't skip the usual steps.

That second step has a name: out-of-band verification. It means confirming something through a separate channel from the one the request came in on. The FBI recommends this approach. Its 2025 alert on impersonation of senior officials advises verifying a contact's identity independently before responding.

Here's a suggested script you can use. Neither Marko nor anyone else said this. It's simply wording that keeps things polite:

"I'll confirm this through our usual contact details and approval process before acting."

Nobody who's legitimate should be offended by that sentence. And if they are? That tells you something too.

What Is a Deepfake Video Call Scam?

A deepfake is synthetic video or audio, generated by AI, that makes it look or sound like a real person said or did something they didn't. A deepfake video call scam uses that technology on a live meeting. You think you're talking to your boss, your co-founder, or your finance lead. You aren't.

This isn't a hypothetical. In its December 2024 public service announcement, the FBI warned that criminals use generative AI to commit fraud, including video used in real-time chats where scammers pose as company executives and other authority figures.

So the old instinct, "I saw their face, so it must be them," doesn't hold up anymore. Recognition and verification used to feel like the same thing. They aren't.

How deepfake CEO scams work

The pattern is usually simple, and that's what makes it work:

Notice that none of these steps require brilliant technology. The deepfake just has to be good enough to stop you from asking questions. The real weapon is social pressure. Challenging your boss feels awkward. Scammers count on that.

This is a cousin of business email compromise, where someone hijacks or spoofs an email account to request payments. Video simply adds a face and voice to a familiar trick.

What the Arup Scam Demonstrates

The best-known case involves Arup, the global engineering firm. According to Construction Briefing's report, Arup confirmed that its Hong Kong operation lost HK$200 million, roughly US$25.6 million, in a 2024 fraud. An employee joined a video call where, as reported, the other participants were deepfake impersonations of colleagues.

I don't want to reconstruct exactly how each fake was produced. The reporting doesn't support that level of detail. But the lesson doesn't depend on the technical specifics.

Here's the thing. The employee wasn't careless. They were on a call that appeared to include multiple familiar people, all apparently agreeing. That's a lot of social proof pointing in one direction. Most of us would feel the same pull.

One caveat matters, too. Arup is a single, very large incident. It doesn't tell you how common these scams are or what a typical loss looks like. It just shows what's possible when a video call is treated as proof.

What Zoom's Verified Human Badge Actually Proves

In April 2026, Zoom announced a way to show that a meeting participant is a verified human. Zoom's April 17 announcement names Tools for Humanity as its partner. Tools for Humanity is the company behind World.

A few terms are worth defining first:

According to Zoom's announcement, the check involves matching a frame from the meeting, an image captured by the Orb, and a selfie taken for authentication on the person's own device. That's more than a basic account login.

The naming and status have also moved on since April. World's October 18 announcement describes World ID for Zoom as available through the Zoom marketplace and calls the marker a "Human Badge." So if you see either "Verified Human" or "Human Badge," they refer to the same idea at different points in its rollout.

Humanness, identity, authority, and trust

This is the most important distinction in the whole article. A video call raises four separate questions:

  1. Humanness: Is there a real person here, rather than a synthetic one?
  2. Identity: Is this person who they claim to be?
  3. Authority: Are they allowed to make this request?
  4. Trustworthiness: Do they intend to act honestly?

A human-verification badge mainly speaks to the first question. It's a useful signal that the person on camera is human. It isn't proof that they're your CFO, that they can approve a payment, or that they mean well. A real human can still lie to you.

Here's how common signals compare:

SignalWhat it can contributeWhat it doesn't establish alone
Familiar face or voiceRecognitionAuthenticity of the caller or request
Human-verification badgeEvidence from a human-verification processJob title, payment authority, or honest intent
Callback to a known numberIndependent corroborationProtection against every account or device compromise
Prearranged code wordAn additional shared-secret checkSafety if the secret has been exposed
Independent second approvalSeparation of payment authoritySafety if both approvals rely on the same deception

No single row is a guarantee. Combined, though, they make a scammer's job much harder.

My Question at the World Booth: What If Someone Steals It?

I spent October 19–21 at Cloudflare Connect 2026 in San Francisco. When I wandered up to the World booth, I was skeptical. Honestly, I was a bit wary of the whole idea.

My worry was simple. If someone steals your password, you change it. But you can't change your eyes. So a stolen eye scan, I figured, would be stolen forever.

I put that to Ian Dilick, who works in Developer Relations at World Foundation. His answer changed how I framed the problem. He explained that a World ID can be revoked and reissued if it's stolen. He also explained that the system isn't meant to track you; in his words, as I noted them, it identifies you anonymously.

I want to be careful here. That's Ian's explanation of how World's system is designed. One conversation at a booth didn't settle every privacy question for me, and it shouldn't settle them for you either. But it did clear up my biggest misunderstanding.

Resetting a World ID doesn't reset your biometrics

Biometrics are physical traits, like your iris or fingerprint, used to identify you. My mistake was mixing up the trait with the credential.

Think of it like a stolen house key. You can change the locks and get a new key. You can't change the fact that someone knows where you live. Different problem, different fix.

Recovery procedures can change, so check World's current documentation before relying on any specific steps.

What "anonymous" does and doesn't mean

According to World's World ID overview, the system lets you prove you're human without sharing details like your name or email address. Separately, World's Personal Custody explanation describes biometric-related information being held on the user's own device.

Those are claims from the provider about how it built the system. They're worth knowing. Still, "proving something without revealing your name" isn't the same as "no personal data involved anywhere." Enrollment still involves your iris. Weigh that for yourself.

A Verification Policy Your Business Can Use Today

You don't need new software to protect yourself. You need a rule everyone follows, including you. Copy this, fill in the placeholders, and share it with your team.

Our video and voice request verification policy

  1. Any request made on a call, video call, or message to send money, change payment details, share credentials, or share sensitive data is unverified until confirmed.
  2. We confirm requests by contacting the person through details already on file in [trusted contact source]. We never use contact details provided in the request itself.
  3. We confirm the specific details: amount, recipient, bank details, purpose, or access requested.
  4. Payments above [payment threshold] require approval from [second approver], contacted independently.
  5. New or changed payment details always require independent confirmation, regardless of amount.
  6. Requests that are urgent, secret, or resistant to verification are escalated to [escalation contact].
  7. A human-verification badge, code word, or familiar face is one signal. None of them authorizes a request alone.
  8. This policy applies to everyone, including founders and executives. Following it is never an accusation.

That last point matters more than it looks. When verification is routine, nobody has to feel like they're calling their boss a liar. It's just how the company works.

Should you use a code word?

A shared code word can add a useful extra check. Just don't let it become the only check. Code words get overheard, written down, or shared. Rotate yours occasionally, and keep it alongside callbacks and second approvals.

Should you ask the caller to turn their head?

You'll see advice suggesting tricks like asking someone to turn sideways or wave a hand in front of their face. I'd skip relying on these. A convincing performance doesn't validate a payment request. Even if the video looks perfect, your answer stays the same: verify independently. You're not a forensic analyst, and you don't need to be.

What to Do If You Already Acted on a Suspicious Request

First, breathe. These scams are designed to fool smart people. Then move quickly.

  1. If you sent money, contact your bank or payment provider immediately, using a number from their official website or your card.
  2. Tell the responsible person in your business right away.
  3. If you shared credentials, use the service's official recovery process, change the affected passwords, and sign out active sessions where possible.
  4. Preserve evidence: messages, call details, meeting links, and transaction records.
  5. Report it. In the US, the FBI directs victims to report fraud through IC3.

Recovery isn't guaranteed. Speed improves your odds, though, so don't wait out of embarrassment.

Frequently Asked Questions

How can I tell if someone on a video call is a deepfake?

Often, you can't reliably tell by looking. So don't make that your test. Instead, verify any consequential request through an independent contact and your approval process. A human-verification badge can add a signal, but it doesn't prove identity or authority.

Can scammers deepfake my boss on Zoom?

The FBI has warned that criminals use AI-generated video in real-time chats while posing as executives. Assume it's possible on any platform, and build your process around verification rather than recognition.

What is Zoom's Verified Human badge?

It's a marker showing that a meeting participant has been verified as a real, unique human using a World ID. Zoom announced it with Tools for Humanity on April 17, 2026. World's October 2026 announcement calls it the "Human Badge."

Does the badge prove someone is who they say they are?

No. It's a signal that the person is human. It doesn't confirm their job title, their authority to make a request, or their intentions.

Can a World ID be reset if it's stolen?

According to Ian Dilick at World Foundation, a World ID can be revoked and reissued. World has also described an Orb-based reset. That replaces the credential. It doesn't change your iris.

How can a small business prevent deepfake payment scams?

Use callbacks to known numbers, require a second approver above a set threshold, independently confirm any changed payment details, and treat urgency and secrecy as warning signs.

Get Clearer Guidance on Your Business's Technology

Deepfakes are one example of a bigger pattern. Technology changes fast, and founders without a technical background are expected to keep up anyway. Knowing which questions to ask, and what a tool actually does, is half the battle.

That's the gap we built UBI to fill for your website and apps. Think of it like daycare for your website: you drop it off, it's looked after, and you get on with running the business.

To be clear about scope: UBI doesn't detect deepfakes, verify meeting participants, or monitor payments. It also doesn't run security tests. What it does is scan your site and show you what's holding it back across SEO, AI search readiness, performance, accessibility, and how well AI agents can use your site. Then it walks you, or your coding agent, through fixing each issue.

Paste your URL at ubi.studio to run a free scan.

Key Takeaways

Sources