Someone Joined Your Video Call as Your CFO. Now What?

Picture this illustrative scenario. It is 5.40 on a Wednesday. A finance manager in Kuala Lumpur gets a meeting invite that appears to come from the group CFO: a confidential acquisition, a short call, please join now. On screen are the CFO, a regional director and an outside adviser. The faces are right. The voices are right. The CFO explains that a deposit must go out before the end of the day and that nobody else can know yet.

Nothing about the call looks wrong, and that is the problem. Live face and voice imitation no longer needs to be perfect. It only needs to survive a short, compressed meeting with someone who has every reason to trust what they see.

The answer is not better eyesight. It is a verification step the person on the screen cannot control. This guide covers why recognition stopped being proof, what to agree before it happens, what to do mid-call, and how to report and preserve evidence afterwards.

Last checked: 28 September 2026.

#How Do You Verify Someone on a Video Call Is Really Who They Claim?

You verify the request, not the video. If a call asks you to move money, change payment details, grant access or share confidential information, end the call politely and confirm through a channel you already trust: the number in your company directory, your internal chat system, or a second approver who contacts the person separately. Never use a phone number, link or email supplied during the call or in the invite. A genuine executive will accept a short delay; resistance to verification is itself a warning sign. Spotting visual glitches is unreliable and should never be the deciding test. Agree the rules in advance, apply them to every rank, and if money has already moved in Malaysia, call your bank's fraud hotline or the National Scam Response Centre on 997 immediately.

#What Happened in the Arup Deepfake Case?

The case most security teams now use as a reference involved Arup, the London-based engineering firm. In February 2024, Hong Kong police described a finance worker at an unnamed multinational who was tricked into paying out about US$25 million after a video conference in which, according to police, every other participant was a deepfake recreation (CNN, 4 February 2024). In May 2024, Arup confirmed to CNN that it had notified Hong Kong police in January about the fraud and that fake voices and images were used.

As reported from police statements, the employee received a message that appeared to come from the company's UK-based CFO about a secret transaction. He first suspected phishing. A video call with what looked like the CFO and colleagues removed that doubt, and he made 15 transfers totalling HK$200 million (about US$25 million) to five Hong Kong bank accounts. The fraud surfaced when he later followed up with the group's headquarters.

In June 2024, Hong Kong's Secretary for Security gave the Legislative Council more detail. Police believed the conference was pre-recorded from public online video clips and voices of the impersonated officer, so there was no real interaction. The fraudster ended the meeting on a pretext and continued the payment instructions by instant messaging.

Two lessons matter more than the technology. First, the employee's instinct was right; the video call overrode it. Second, the check that exposed the fraud, contacting head office directly, was available all along. It simply came after the money instead of before.

#Why Seeing and Hearing Someone Is No Longer Proof

A deepfake is synthetic audio, video or imagery generated or altered by machine learning so that a person appears to say or do something they did not. In a live call, the attacker does not need a flawless fake. They need one good enough for a webcam feed, poor lighting and a meeting that lasts minutes.

Official guidance has caught up with this. The FBI's December 2024 public service announcement on criminal use of generative AI warns that criminals generate videos "for real time video chats with alleged company executives, law enforcement, or other authority figures". Its September 2026 warning on law enforcement and government impersonation says AI lets scammers "appear as law enforcement and government officials on video calls with victims". The joint NSA, FBI and CISA information sheet Contextualizing Deepfake Threats to Organizations (September 2023) lists impersonating "key leaders or financial officers" to authorise payments among the main threats to organisations.

What about spotting the fake? The FBI still lists visual imperfections to look for, such as irregular faces, lag and unrealistic movement. The same advisory also tells people to verify by hanging up and calling a number they have researched themselves. That second step is the one that holds up. Artefacts shrink with each generation of tools, and a video call already hides a lot behind compression. Worse, someone who looked closely and saw nothing odd can feel more confident, not less. Treat glitches as a reason to verify, never their absence as a reason to trust.

The same logic applies to voice alone. If the call is audio only, our guide to AI voice cloning attacks covers how those calls are built and defeated.

#Which Requests on a Call Need Verification?

Not every meeting needs a security check. Verification is for requests where a wrong decision is expensive or hard to reverse. Define them once, in writing, so nobody has to judge it under pressure:

• Any payment outside the normal cycle, or any payment described as urgent or confidential.
• A new payee, or a change to an existing supplier's or employee's bank details.
• Access requests: new accounts, password or MFA resets, admin rights, remote access.
• Sharing confidential data: payroll, customer lists, deal documents, credentials.
• Any request to skip, shorten or delay a normal approval step.

Everything else is an ordinary meeting. Keeping the list short is what makes the rule usable.

#Red Flags on a Video Call and What to Do About Each

None of these proves a call is fake. Real executives do make urgent requests. Each flag simply maps to one verification action, so the response is automatic rather than a judgement about whether someone looks real.

The last row matters most. A deepfake can improve every month. Refusing a ninety-second check does not become more convincing with better software.

#The Verification Protocol for Video Calls and Meeting Requests

Out-of-band verification means confirming a request through a separate channel that the requester did not supply and does not control. This is the sequence to agree and practise:

1. Classify the request. If it falls in a high-risk category, the protocol applies, whoever is asking.
2. Pause without apology. A short, neutral line works: you will confirm through the usual process and come straight back.
3. End the call or step away. Do not keep negotiating on the channel that made the request.
4. Contact the person through a known channel: the directory number, the internal chat account you already use, or in person.
5. Get a second approver for anything that moves money or access, contacted separately by that approver, not added to the same call.
6. Act only when the request is confirmed through the separate channel and the normal approval workflow is complete.
7. Log the request either way, including false alarms, and tell the security or IT team.

This matches the direction of official advice. The NSA, FBI and CISA sheet recommends identity verification that works during real-time communications, including liveness testing and multi-factor checks, and says these steps are "especially important" for financial transactions. For most organisations, the practical form is a second channel and a second person. MyCERT's May 2026 boss impersonation alert gives the same advice to Malaysian organisations: confirm sensitive requests through a phone call, official messaging platform or face-to-face, and require secondary verification for financial transactions.

#What Finance Teams and Executives Should Agree in Advance

A protocol invented during the call will not survive it. These decisions belong in a short written policy, signed off by leadership:

• The rule applies to everyone. The CEO and CFO are verified exactly like anyone else, and they say so publicly.
• No payment, payee change or access grant is ever approved on the strength of a call or video alone.
• A known-contact directory for executives, key suppliers and your bank, kept outside email and checked regularly.
• Confidentiality never removes a step. A genuine deal can still go through approved channels and approvers.
• A backup contact for each executive, such as an assistant or delegate, for travel and leave periods.
• Meetings about payments are scheduled through the company calendar and corporate accounts, not personal email or new messaging accounts.
• An optional verification phrase for executives and finance, agreed in person, never sent by email or chat, and changed if it may have leaked.
• Staff who pause and verify a senior person are thanked, never criticised. Leaders commit to this in writing.

The last point decides whether the rest works. People skip verification when it feels socially risky. Our piece on the psychological levers social engineers use explains why authority and urgency override good judgement, and a policy that removes the social cost is the fix. The wider argument for process over tools is in why social engineering beats your security stack.

#What to Do Mid-Call When Something Feels Off

You do not need to prove the call is fake, and you should not try. You only need to avoid acting on it until it is verified.

• Stay calm and polite. You are following a process, not accusing anyone.
• Do not approve, transfer, share a screen with banking open, or read out any code during the call.
• Do not click links or open files sent in the meeting chat.
• Note what you can: the meeting platform, meeting ID, participant names and the time.
• Leave the call, then verify through your known channel as in the protocol above.
• If the request turns out to be genuine, you have lost a few minutes. If not, you have stopped the fraud at the cheapest possible point.

#What to Do After a Suspected Deepfake Call

Speed matters most when money has moved, so the bank call comes first. Work through the rest whether or not anything was paid:

1. If money moved, contact your bank's fraud hotline or the National Scam Response Centre on 997 immediately. Bank Negara Malaysia advises scam victims to contact their financial institution or NSRC at 997 immediately.
2. Preserve evidence before anything is deleted: the invite and email with full headers, the meeting ID and link, participant names and handles, chat messages, call logs, screenshots, any recording your policy allows, and all transaction records.
3. Tell the person who was impersonated through a known channel. Their email or messaging account may have been compromised, which changes the response.
4. Report internally to IT, security, finance leadership and legal.
5. Make a police report, and keep the report number for your bank and insurer.
6. Report the incident to CyberSecurity Malaysia's Cyber999 response centre, especially if accounts or systems may be compromised.
7. Warn colleagues who could be approached next. These campaigns often target more than one person.
8. Review the process gap, not the person. Ask which control would have stopped the request, then add it.

If an executive's likeness is also being used in fake social media profiles or videos, our impersonation evidence guide explains what to capture before reporting it to the platform.

#What Deepfake Fraud Looks Like in Malaysia

Malaysian police have been tracking deepfake-assisted fraud for some time. On 28 August 2024, the director of Bukit Aman's Commercial Crime Investigation Department said police in Malaysia were investigating 454 fraud cases believed to involve deepfake technology, including voice impersonation, with losses of RM2.72 million between the start of 2024 and that date (Malay Mail, reporting Bernama, 28 August 2024). Those were cases under investigation, not a full-year total. He said the scams typically involved WhatsApp messages impersonating the victim's acquaintances and asking for a loan, not video meetings.

The police advice at the time was the same principle this guide rests on: do not believe what is displayed or what you hear, and verify by contacting people on the numbers already saved in your phone. The pattern also overlaps with the "boss impersonation" emails MyCERT flagged in May 2026, which were sent mainly to executives' personal email addresses and pushed recipients off official channels. A video call is often the second step after a message like that.

#Why Rehearsal Beats Detection Tools

Detection tools for synthetic media exist and can help, but they are rarely present on every channel an attack can use, and they compete with tools that improve constantly. A process does not depend on winning that race.

The NSA, FBI and CISA sheet recommends that organisations plan their response to deepfakes, run tabletop exercises involving the most likely targets, including executives, and train staff on the procedures for responding to and reporting suspected manipulated media. Rehearsal turns a policy into a habit. A finance manager who has practised ending a call and verifying will do it far more readily when the real one arrives.

Know what is public about your leaders, too. Recorded talks, interviews and company videos give an attacker material, and org charts and announcements give them a story. Our guide to how attackers research your company shows what to review, and digital identity protection covers the public-profile side.

Awareness training helps when it rehearses the decisions people actually face. We explain what that looks like in why security awareness training is broken.

#Deepfake Call Readiness Checklist

• High-risk request categories are written down and known to finance, HR, IT and executive assistants.
• No payment or access change is approved on a call or video alone.
• A known-contact directory exists outside email and is current.
• Every high-value or unusual payment needs a second, separately contacted approver.
• Executives have publicly committed to being verified, and have backup contacts for travel.
• Payment-related meetings run through corporate calendars and accounts only.
• Staff know how to report a suspicious call and who acts on the report.
• The response steps, including your bank's fraud line and 997, are written down and easy to find.
• The organisation has rehearsed a deepfake scenario in a tabletop exercise or authorised simulation.

#How AwareXone Approaches Deepfake Scenarios

AwareXone is a Malaysian security company. Our authorised social-engineering testing and training can include deepfake video call and voice scenarios for the teams most likely to be targeted, followed by coaching and a review of the approval processes involved. Every engagement runs on written authorisation, an agreed scope and scenarios, and an emergency stop contact, and reports do not name individuals. The aim is to find where a process gives way under pressure, not to catch people out. You can read how we work.

#Frequently Asked Questions