How to Spot Deepfake Video Calls Before They Drain Your Company

Learning how to spot deepfake video calls is no longer a niche security skill. On November 12, 2026, the FBI linked the FaceStealer scheme to North Korean hackers and said it has stolen more than $400 million, mostly through fake Zoom and Teams meetings.

According to The Hacker News, authorities seized the cloud infrastructure behind the operation along with more than 900 recorded victim webcam videos. The attack chain is painfully simple: hijack one person’s chat account, message their contacts about an “investment call,” send a lookalike meeting link, play recorded or deepfaked footage of real people, then fake an audio problem and get the target to run a “fix.” That fix is malware. More than 80% of recent targets were founders or C-suite executives. The FBI’s FaceStealer page has the official details. This guide is about what to actually do on Monday morning.

What You Need Before You Start

You do not need a big security team to put these controls in place. You need:

• A list of high-risk people: executives, finance staff, anyone who approves payments or holds crypto keys, and your open source maintainers.
• Admin access to your Zoom or Microsoft Teams tenant, your identity provider (Okta, Microsoft Entra ID or Google Workspace) and your endpoint security tool.
• An hour of leadership time to agree on a verification rule everyone will follow, including the CEO.

Step 1: Set a Verification Rule for Every Unexpected Meeting

The single strongest defence is boring: verify through a second channel. If a contact suddenly asks for a call about money, investment, credentials or software installs, confirm it with them on a different channel you already trust. Call their known phone number. Message them on a different app. Do not reply inside the thread that sent the invite, because that account may be the compromised one.

Write this down as a one-paragraph policy. Something like: “Any request to move money, share keys, or install software that arrives through chat or a meeting must be confirmed by phone using a number from our CRM or directory.” Then make leaders follow it publicly. People copy what executives do, not what the policy says.

A shared code word helps too. Some finance teams agree on a rotating phrase for payment approvals, changed every month and never typed into chat. If the person on the call cannot give it, the request stops there.

Step 2: Check the Meeting Link Before You Click

FaceStealer used typosquatted meeting links that arrived shortly before the call. Train people to read the domain, not the display text. Real Zoom links end in zoom.us. Real Teams links start with teams.microsoft.com or teams.live.com. Real Google Meet links sit on meet.google.com. Anything like “zoom-meet.app” or “teams-join.live” is a red flag.

On the technical side, turn on DNS filtering (Cloudflare Gateway, Cisco Umbrella or similar) to block newly registered domains, and configure your email and chat security to flag lookalike conferencing domains. A link sent five minutes before a meeting by someone who scheduled it through Calendly a week ago deserves a second look.

Step 3: Watch for Deepfake and Replay Signs During the Call

Deepfakes keep improving, so do not rely on spotting glitches alone. Still, these signs are worth knowing:

• Participants who never interact naturally: recorded footage cannot react to what you say. Ask a specific question by name and watch for a delay or a vague answer.
• Lip-sync and lighting oddities: mouths that drift out of sync, faces that blur when the person turns, lighting on the face that does not match the room.
• Cameras that stay “broken”: a key person who will only appear in a short clip or with a frozen frame.
• A live challenge: ask the person to do something unscripted, like turning their head fully sideways, holding up today’s newspaper or answering a question only the real person would know.

If anything feels off, end the call politely and verify through your second channel. Being slightly awkward costs nothing. Being wrong can cost millions.

Step 4: Never Run a “Fix” Someone Gives You on a Call

This is where FaceStealer actually wins. The meeting shows a fake audio error, then offers a fix: a script to paste into Terminal or PowerShell, a “driver update” or an SDK download. Researchers often call this lure pattern ClickFix, and it works because the victim runs the malware themselves.

Make the rule absolute: nobody runs commands, installs plugins or downloads updates offered during a meeting. Real audio problems are fixed by rejoining, switching devices or using the official app’s settings. Back it up technically. Remove local admin rights for most users, enable application allowlisting where possible and make sure your EDR (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne) alerts on PowerShell and Terminal commands spawned from browsers.

Step 5: Lock Down Chat Accounts and Crypto Keys

The scheme spreads by taking over messaging accounts, often Telegram, and using them to message the victim’s contacts. Turn on Telegram’s two-step verification password, review active sessions regularly and kick out any device you do not recognise. For corporate accounts, enforce phishing-resistant MFA such as FIDO2 security keys or passkeys.

If your company holds crypto, keep large balances in multi-signature wallets or with a qualified custodian, never in a hot wallet on an executive’s laptop. Seed phrases should never be stored on a computer that joins video calls.

Step 6: Prepare an Incident Playbook

Assume someone will eventually click. Write down who to call, how to isolate the laptop, how to revoke sessions and rotate keys, and how to warn contacts that the account was hijacked. Report incidents to the FBI’s Internet Crime Complaint Center (IC3) quickly, since speed matters for any chance of freezing funds. CISA also publishes guidance worth bookmarking.

Common Mistakes to Avoid

Trusting a familiar face. FaceStealer used real recorded footage of earlier victims and scraped interviews. Seeing someone you know on screen proves nothing anymore.

Training only junior staff. Executives are the main target here. If your awareness program skips the C-suite, it skips the people attackers want most.

Treating it as a crypto-only problem. The same group targeted an Axios npm maintainer, which led to a trojanized package release. Any developer with publish rights is a supply chain target.

Key Takeaways

• Verify out of band: Confirm unexpected money or software requests through a separate, trusted channel.
• Read the domain: Real meeting links live on known domains. Lookalikes are a warning sign.
• Challenge live: Ask unscripted questions. Recordings cannot answer them.
• No fixes on calls: Never run a command or install anything offered during a meeting.
• Harden accounts: Phishing-resistant MFA, Telegram two-step verification and cold storage for keys.

Need Expert Help?

If this feels like a lot to manage alone, TecniForge can handle the heavy lifting. Our team specializes in custom software development and AI integration. Get in touch with our experts.

Also read: FaceStealer Deepfake Scam: 7 Ways to Protect Your Team From Fake Video Calls, our earlier coverage on why this matters today.

Here is a quick test for this week: send your leadership team a calendar invite for a fake “investor call” with a slightly wrong link, and see who checks before clicking. Whatever the result, you will know exactly where to start. That is how to spot deepfake video calls as a team, not just as individuals.