Deepfake Video Call Fraud: How to Protect Your Meetings

A familiar face on a screen is no longer proof of who you are talking to. On 19 October 2026, INTERPOL launched a public awareness campaign on AI deepfake scams, and one of its example scenarios is exactly what finance teams fear most: a video call from a “colleague” asking for a bank transfer. Deepfake video call fraud has moved from a rare headline to a mainstream risk.

This guide explains what changed this month, how these attacks actually work, and the practical steps any organisation can take to make its meetings harder to impersonate.

INTERPOL’s warning: a convincing video proves nothing

According to INTERPOL’s 19 October 2026 announcement, issued from Singapore, the campaign consists of three short videos that were themselves generated with AI, to show the public how realistic synthetic media has become. Its slogan is “Wait. Validate. Don’t take the bait.” The campaign covers impersonation, investment and romance scams, along with sextortion, deepfake pornography and disinformation, and it is the public-facing part of INTERPOL’s Project SynthWave PLUS, which is supported by the Government of Japan.

Toshinobu Yasuhira, Director of the INTERPOL Innovation Centre, put the core problem simply: AI is removing the obvious signs that used to give a scam away. That is the shift every business needs to absorb. Glitchy faces and robotic voices were once the giveaway. Today, the warning signs are behavioural, not visual.

INTERPOL’s red flags are worth sharing with every team that approves payments or shares data:

• Unsolicited contact from someone posing as a colleague, relative or trusted organisation that steers towards financial or banking details
• Pressure to act immediately, often wrapped in a crisis or emergency
• Requests for secrecy that stop you from checking with others
• Hard-to-trace payment methods such as wire transfers, cryptocurrency or gift cards

For organisations, INTERPOL recommends mandatory training on deepfakes and voice phishing, multi-step verification for financial transactions and data transfers, and face-to-face confirmation for large sums.

How deepfake video call fraud actually works

Two cases show the pattern. The first is still the textbook example. As Brandefense’s case analysis recounts, in January 2024 an employee in Arup’s Hong Kong office was first suspicious of a message about a confidential transaction. A video conference was then arranged, in which the chief financial officer and several colleagues appeared, all of them deepfakes. Reassured by seeing familiar faces, the employee authorised 15 transfers totalling about HK$200 million (roughly US$25.6 million), and only discovered the fraud after checking with headquarters.

The second case is recent. Biometric Update reported on 15 October 2026, citing Reuters, that fraudsters stole €95 million from Fideuram, the private banking arm of Intesa Sanpaolo. The scheme began with a WhatsApp message that appeared to come from the group CEO, asking for urgent help with an overseas transaction, followed by a phone call using an AI-cloned voice of a senior lawyer. Transfers went mainly to accounts in China and Hong Kong. The same report says part of the money was recovered, while a substantial sum is believed to have been moved overseas and converted into cryptocurrency.

The common thread is not the quality of the fake. It is the channel. In both cases the attacker controlled how the conversation started: the message, the meeting link, the phone number. Once the victim accepted that channel as genuine, the deepfake only had to be good enough to confirm what the victim already believed.

India is firmly in the picture. The same Biometric Update article notes that an identifAI report ranks India second only to the United States for observed deepfake incidents, at 7.73 percent. Closer to home, ETV Bharat reported on 11 June 2026 that the Union Home Ministry’s Indian Cyber Crime Coordination Centre (I4C) warned that criminals are creating digital replicas of people to get past facial authentication, liveness checks and video-KYC. Notably, the advisory said victims can unknowingly hand over facial data during video calls or online interviews in which they are asked to look at the screen, blink, turn their heads or speak.

Why your meeting channel is part of your security perimeter

Most companies treat video meetings as a convenience tool, not a security system. Anyone can create a meeting on a free account, give it a plausible name and send the link from a lookalike email address. To the person receiving it, a link on a consumer meeting service looks the same whether a real colleague or a fraudster created it.

That is why the most useful defence against executive impersonation scams is not trying to spot a fake face. It is making genuine internal meetings recognisable and controlled, so an outside invitation stands out. Brandefense makes a closely related point: verification calls should use numbers from your own corporate directory, never a number supplied in the invitation, chat or email signature that arrived with the request.

Ask three questions about your current setup:

1. Can staff tell an official company meeting from a lookalike? If every meeting lives on a generic public domain, the answer is usually no.
2. Are invitations authenticated? Email that passes SPF, DKIM and DMARC checks on your own domain is far harder to spoof than a message from a random free mailbox.
3. Who controls entry? If anyone with the link can walk straight into a sensitive call, you have no gate to check who is joining.

A practical playbook against deepfake meeting scams

No single tool stops deepfake video call fraud. The strongest protection combines process with controlled infrastructure. Here is a playbook drawn from the INTERPOL and Brandefense guidance, adapted for Indian organisations:

• Never treat a video call as payment authorisation. Payments, beneficiary changes and credential resets should be executed in a separate system with its own approvals, never “approved on the call”.
• Call back on known numbers. Verify unusual requests through a channel you already hold, such as the corporate directory, not one supplied by the requester.
• Use dual approval with independent approvers. Two people who were not on the same meeting should sign off on large or unusual transfers. Many transfers to several new accounts should trigger an alert by itself.
• Hold new beneficiaries. A short cooling-off period for new or changed bank details gives time to confirm through established contacts.
• Agree challenge phrases. INTERPOL suggests a private “safe word” for families; leadership teams can use private phrases agreed outside normal channels and changed regularly.
• Make verification safe. Leaders should state in writing that slowing down a payment to check it will never count against an employee.
• Run official meetings on official channels. Put internal and client meetings on your own branded domain, send invites from authenticated company email, and use a lobby so hosts admit each guest.
• Keep a record. Recordings and attendance registers help investigators reconstruct what happened if an attempt does get through.

You can find more guidance on meeting governance across the InstaDataHelp blog.

How InstaDataTalk helps you run verified, controlled meetings

InstaDataTalk is a self-hosted, white-label video meeting platform that you deploy on your own infrastructure. It is not a deepfake detector, and no meeting platform can make a fake face harmless on its own. What it does offer is a meeting channel that your organisation owns and controls, which supports the process controls above:

• Your domain, your brand. Meetings run on your own domain over HTTPS, with your name, logo and colours across the app and every email, so staff learn what an official meeting looks like.
• Authenticated meeting email. Invitations and reports go out through professional authenticated email with SPF, DKIM and DMARC and a transactional relay, from your own email identity.
• Lobby and admission control. Guests wait in a lobby until the host admits them, with mute-on-entry and permission settings, and hosts can remove participants or end the meeting for everyone.
• Calendar invites with .ics files and post-call report links, so meetings arrive in a consistent, recognisable format.
• An automatic, downloadable attendance register for every meeting, plus recording with one-click MP4 download.
• Your storage, your rules. Recordings, files and transcripts are kept in your own S3-compatible cloud storage with an automatic retention lifecycle.
• An admin control centre covering users, meetings, storage, AI and email health, key rotation and diagnostics.

Combined with a clear rule that payments are never approved inside a meeting, a branded, controlled channel makes an outside “urgent call from the CFO” easier to question.

Frequently Asked Questions

What is deepfake video call fraud?

Deepfake video call fraud is a scam in which criminals use AI-generated video or cloned voices to impersonate a trusted person, such as a senior executive, colleague or relative, during a call, usually to push the victim into transferring money or sharing sensitive data.

What did INTERPOL announce in October 2026?

On 19 October 2026, INTERPOL launched a public awareness campaign of three AI-generated videos showing how deepfakes are used in scams. Its message is to wait and validate before acting, and it recommends multi-step verification and face-to-face confirmation of large payments for businesses.

Can a meeting platform detect deepfakes?

Detection tools exist, but they should not be your only defence. The more reliable approach is process: never authorise payments on a call, verify requests through known channels, require independent dual approval, and run official meetings on a controlled, branded channel with lobby admission.

How does InstaDataTalk help reduce meeting impersonation risk?

InstaDataTalk runs on your own infrastructure and domain, sends invitations through authenticated email with SPF, DKIM and DMARC, holds guests in a lobby until the host admits them, and keeps an automatic attendance register and recordings in your own storage. It is not a deepfake detector, so it works alongside verification procedures.

Sources

• INTERPOL: Public awareness campaign highlighting the risk of AI deepfake scams (19 October 2026)
• Biometric Update: Italian bank loses $108M to AI messaging fraud as identifAI warns of deepfake threat (15 October 2026)
• Brandefense: Deepfake video call wire fraud and the Arup case
• ETV Bharat: MHA deepfake alert on AI replicas bypassing biometric checks (11 June 2026)

Deepfakes win when attackers control the channel, so take the channel back. Explore InstaDataTalk to run branded, self-hosted meetings on your own domain, or write to info@instadatahelp.com to plan a deployment.