How to Spot a Deepfake Video Call Before You Wire Money

The FBI Warning You Probably Missed

On December 3, 2024, the FBI's Internet Crime Complaint Center published a public service announcement specifically calling out real-time video chats with fake executives as a now-active fraud technique. ^[1]

On December 19, 2025, IC3 followed up with a second PSA on AI-generated voice and text messages impersonating senior U.S. officials, complete with the red flags the FBI wants every finance team to memorize. ^[2]

Both PSAs list the same handful of tells. None of them require a degree in machine learning. You just have to know to look.

What "Real-Time Deepfake Video Call" Actually Means in 2026

A live deepfake video call is not a recording played on a second screen. It is a generative AI model that takes a target's face, voice, and head pose and re-renders them frame by frame, at the latency of a normal video conference, while the attacker drives the conversation in real time. The defender on the other end sees the right face moving the right way, on the right kind of background, in the right kind of lighting, responding to questions with plausible lag.

The FBI's December 2024 PSA puts it bluntly: "Criminals use AI-generated videos to create believable depictions of public figures," and one of the specific examples the agency lists is "real-time video chats with fake executives or law enforcement." ^[1]

Hong Kong police have separately confirmed that at least one 2024 case involved a finance worker participating in a multi-person video conference where every other participant was a synthetic recreation of real company staff, including the CFO. The worker authorized a transfer after the video call, then later checked with corporate headquarters and discovered the conversation had never happened. ^[3]

The technology is now cheap, off-the-shelf, and the barrier to entry is "one public-facing video of the target on YouTube." You do not need to be a nation state to pull this off.

The Red Flags the FBI Wants You to Memorize

The two FBI PSAs that anchor this guide list overlapping tells. They are short on purpose: anyone in a finance or HR role needs to be able to recite them under pressure.

Visual tells in a live video feed

The December 2024 PSA directs viewers to look for "subtle imperfections" and lists five specific things to check for. They are paraphrased here exactly as the FBI framed them: ^[1]

Distorted hands or feet. Generative video still fumbles anatomy most visibly at the extremities. Watch for extra fingers, fused fingers, missing fingers, and wrists that bend in ways the model has not learned to disallow.
Unrealistic teeth or eyes. Teeth are a high-frequency texture; the model smooths them. Eyes are the part of the face humans are wired to scrutinize, so any micro-misalignment reads as "off."
Irregular faces. As the person on the call turns their head, look for face geometry that warps, a hairline that shimmers, or earrings that change shape between frames.
Inaccurate shadows. The light direction on the face should match the light direction on the background. A real-time deepfake often gets the face lit from one direction and the background from another.
Watermarks. Some AI video tools stamp a visible or near-visible watermark on the output. It is not a guarantee either way, but if you see a faint repeating pattern, treat it as a flag.

Audio and timing tells

The same PSA also flags timing issues. ^[1]

Lag time. Real-time deepfake pipelines introduce a small but consistent delay between when a question is asked and when the answer begins, because every frame has to be regenerated. If the other party's response is consistently a half-beat late, that is a signal, not a connection issue.
Voice matching issues. Tone, cadence, accent, breathing rhythm, filler words. A cloned voice can sound like the person on the surface and still be missing the idiosyncratic patterns that close colleagues would notice.

Behavioral tells the December 2025 PSA adds

The follow-up IC3 PSA, on the impersonation of senior U.S. officials, adds a behavioral layer that is independent of the underlying video. ^[2]

The contact "moves" you off the original channel. In the PSA's case pattern, the first message arrives by SMS. Within a few messages, the impersonator asks to move the conversation to an encrypted app like Signal, Telegram, or WhatsApp, where the company's normal identity and authentication controls are not in play.
The impersonator is suspiciously knowledgeable. The PSA notes the actors almost immediately steer the victim to a topic the victim is "versed on," current events, or bilateral policy negotiations. The fluency is the lure.
A plausible pretext for money or credentials. Wire funds to an "overseas financial institution under false pretenses," provide a 2FA code so the impersonator can mirror your contacts, or supply a passport scan. Anything that adds urgency and changes the normal payment or authentication path is a tell.

The Verification Steps That Actually Work

The FBI's red flags are for triage. They tell you when to slow down. They do not, by themselves, tell you that a call is real. For that, you need a separate channel.

Step 1. Hang up and call back on a verified number.

Both PSAs repeat the same advice: do not trust the contact information the caller gives you. Hang up. Find the phone number from a source that is not the call itself: the company directory, a previous business card, a recent invoice. Call that number and ask for the person by name. ^[1] ^[2]

This is the single most reliable step, and it costs you about two minutes. A real executive will not be insulted. A deepfake will not be able to answer a callback to a number the model was not given.

Step 2. Use a shared secret phrase.

The December 2024 PSA specifically recommends that families and small organizations "create a secret word or phrase" to verify identity. ^[1] Extend this to business: any video call that authorizes a payment above a threshold (set the threshold in your finance policy and stick to it) should require a previously agreed phrase that is not in any email, chat log, or public source.

Step 3. Use an out-of-band channel for the action itself.

The PSAs do not say this in so many words, but the through-line is the same: the request and the action have to happen on independent channels. If the video call asks you to wire money, the wire instruction has to come from a system the video caller did not touch: a known-good banking portal, a previously verified phone number for the controller, or a countersignature workflow that runs on hardware tokens. ^[2]

Step 4. Limit the public raw material an attacker can train on.

The FBI's longer-term mitigation in both PSAs is to limit the public content an attacker can scrape to build the model in the first place. ^[1] ^[2] This does not mean disappearing from the internet. It does mean:

Making personal social media accounts private.
Removing long-form public video (talking-head keynotes, conference talks, podcast appearances) that gives a model hours of clean audio and consistent lighting on a single face.
Treating any public video of yourself as raw material a future attacker will train on. The model that cloned a CFO did not need access to private files; it needed a YouTube link.

What Detection Tools Can and Cannot Do

The U.S. government's biggest public investment in deepfake detection is DARPA's Semantic Forensics (SemaFor) program, which wrapped in 2024. The premise, as DARPA's program page frames it, is that purely statistical detection gets defeated quickly as generative models improve, but automated generators remain prone to "semantic errors" like mismatched earrings, geometry that drifts across frames, and lighting that does not line up. ^[4]

That premise, find one inconsistency rather than catch every pixel, is the same one the FBI is asking human viewers to apply. DARPA's SemaFor program manager, Dr. Wil Corvey, said in March 2024 that "our investments have seeded an opportunity space that is timely, necessary, and poised to grow," and announced the AI Forensics Open Research Challenge Evaluation (AI FORCE), an open challenge for models that distinguish authentic from fully synthetic images. ^[5]

The honest read: enterprise detection tools exist, but they are not consumer-grade, they lag the latest generative models by months, and the FBI's advice does not assume you have one. Treat any "AI deepfake detector" browser extension or app with suspicion until you can name the model and the publication it was evaluated against.

What to Do If You Suspect You Are on a Deepfake Call Right Now

Do not act on the request. Whatever the caller is asking for, money, credentials, a 2FA code, a passport, pause. The whole point of the attack is to make the request feel normal and the pause feel rude.
Say you need to switch to a verified channel. A real colleague will accept a callback. A deepfake will try to talk you out of it.
Look at the hands, the teeth, the earrings, the shadows, and the response lag. If any of them are off, treat the call as compromised regardless of how convincing the rest of the image looks.
Hang up and call the person back on a number you already had. Not the number the caller provides, the one in your own records.
Report the attempt. File at ic3.gov, even if no money moved. The FBI uses attempted-fraud reports to track these networks. ^[2]

What It Comes Down To

Real-time video deepfakes have moved from "theoretically possible" to "documented in FBI public service announcements and confirmed in a 2024 case where a finance worker wired company money after a video call where every other participant was synthetic." ^[1] ^[3]

The human detection rate for high-quality video deepfakes in controlled studies is poor. The FBI is not telling you to develop a better eye. It is telling you to assume the video can be faked, slow down, and verify through a channel the video did not touch. That last step is what stops the wire transfer, and it does not require any AI at all.

Deepfakes and Synthetic Media, the broader deepfake landscape and how detection has failed
AI Voice Clone Scams: 3 Seconds of Audio Is Enough, the audio-only cousin of the same attack
AI-Powered Scams: Complete Guide, where deepfake video calls fit in the wider fraud stack
AI Scam Tools on the Dark Web, the kits behind real-time video deepfakes