The $25 Million Zoom Call That Never Happened: Live Deepfake Video Scams Explained

The $25 Million Zoom Call That Never Happened

In early 2024, a finance employee at the global engineering firm Arup joined what looked like a routine video conference. The company's CFO was on the call. So were several colleagues from the London office. The CFO explained an urgent acquisition that needed immediate processing — and instructed the employee to make a series of wire transfers totaling $25.6 million.

The employee did what he was told. Every face on that call looked real. Every voice sounded right. The body language was natural. He recognized everyone.

He shouldn't have. Every other person on that call was an AI-generated deepfake. The CFO never joined. Neither did the colleagues. Twenty-five million dollars left the company before anyone realized what had happened.

This wasn't a glitch in some experimental scammer toolkit. This is where corporate fraud is in 2026. And it's not just CFOs anymore — it's coming for romance scam victims, job seekers, and anyone who joins a video call with someone they haven't met in person.

What Makes a "Live" Deepfake Different

The deepfakes you've probably heard about are pre-recorded — fake videos of celebrities pushing crypto, fake CEO statements, edited political clips. Those are bad enough. But they have a critical limitation: they can't react to you.

Live deepfakes are different. They run in real time. The scammer sits in front of their own camera, and AI software replaces their face and voice with someone else's — frame by frame, word by word, as they're speaking. They can hold a real conversation. They can answer questions. They can react to whatever you say.

Free and low-cost software now makes this possible on a regular gaming PC. The technology that took Hollywood VFX teams months in 2020 takes a Discord tutorial and a $400 GPU in 2026.

That's the part that should keep you up at night. A scammer doesn't need a film studio. They need a laptop and 30 seconds of footage of whoever they want to become.

How the Scam Actually Plays Out

The most common live deepfake scam patterns right now:

Executive impersonation. A finance team member gets invited to an "urgent" video call about a confidential transaction. The CEO or CFO is "on the call." So is "outside counsel." So is "the bank rep." Every one of them is a deepfake. The pressure is engineered: act fast, don't tell anyone, the deal closes today.

Vendor video verification. A scammer compromises a real vendor's email, then schedules a "verification call" to update the wire instructions. The "vendor contact" on the video call is a deepfake of someone you've actually worked with. The new wire details go to the scammer's account.

Romance scam video dates. A months-long online relationship finally agrees to a video call. The "person" you've been talking to appears on screen. They look exactly like the photos you've seen. They speak. They react. You feel relief — finally, a real person. They are not a real person. The scam continues for thousands of dollars more.

Job interview fraud. A scammer pretending to be a recruiter from a major company conducts a "video interview" with a candidate. The recruiter is a deepfake. The job is fake. The "onboarding" requires personal information, banking details, and sometimes upfront payment for "equipment."

Red Flags During a Live Deepfake Call

The technology is good. It's not perfect. Here's what to watch for:

Eye and blinking issues. Real humans blink every 2-10 seconds with subtle muscle movements around the eye. Live deepfakes often blink mechanically, with strange timing, or stare for unnaturally long stretches.

Slight audio lag. Live deepfake voice replacement adds a tiny delay between what the scammer actually says and what you hear. It's subtle — usually less than half a second — but you can feel it. Conversations feel slightly "off-rhythm."

Lip sync inconsistencies. Watch the mouth carefully on sounds like "M," "F," "P," and "V." These require specific lip shapes that real-time AI often gets just slightly wrong.

Lighting that doesn't match. Shadows on the face don't quite line up with lighting visible elsewhere in the frame. The face may look slightly "pasted on."

Hair and ear edges. Watch the boundary between hair and background. Live deepfakes often show subtle blurring, flickering, or color shifts at these edges.

Background warping. Movement behind the person may look slightly distorted, as if the AI is struggling to handle complex motion.

Unusual reluctance to do simple physical things. Touch their nose, wave their hand in front of their face, hold up three fingers. Deepfakes struggle with spontaneous physical movements that the AI hasn't been trained to handle smoothly.

The Verification Test (Use This on Any Suspicious Call)

If you have any doubt about who you're really talking to, run this test. It takes 10 seconds and there's no good way to fake it:

1. Ask them to wave their hand in front of their face slowly. Real video shows the hand passing naturally over the features. Live deepfakes often glitch — the face distorts, the hand merges with the background, or the AI temporarily loses tracking.

2. Ask them to turn their head fully sideways. Live deepfakes work best when the face is mostly forward-facing. A 90-degree profile view often breaks the illusion.

3. Ask an unexpected personal question only the real person would know. "What's the name of the coffee shop near the office?" "Who sent the meeting invite?" Real people answer naturally. Scammers fumble or deflect.

4. Demand a callback through a verified channel. "I'll call you back on your office line in 5 minutes." A real executive will agree instantly. A deepfake operator will invent reasons you have to handle it right now.

If they refuse the test, refuse to call back through verified channels, or get angry that you're asking — you have your answer. Hang up. Verify through your normal channels. Tell your security team or your bank.

What to Do If You've Already Been Targeted

If money has already moved:

1. Call the bank's fraud line immediately. Wire transfers can sometimes be recalled within hours. Don't wait until tomorrow.

2. Document everything. Screenshot the call invite, the email it came from, any chat messages, and the wire confirmation. Note times and details.

3. Report it. File with the FBI at ic3.gov — they have a dedicated team for business email compromise and deepfake fraud. Then file with the FTC at reportfraud.ftc.gov.

4. Notify your security team. If this was a corporate scam, the same operation is probably targeting your colleagues right now.

5. Watch for follow-ups. Recovery scams target recent victims. Anyone who contacts you offering to "recover" the funds for an upfront fee is a second scam.

The Bottom Line

Live deepfake video calls are no longer theoretical. They've stolen tens of millions of dollars from real companies. The technology is cheap, the tutorials are free, and the scammers are getting better at it every month.

The defense is not "trust your eyes." Your eyes will lose. The defense is verification through a separate channel — a phone call to a number you already have, a callback through your company's official directory, an in-person check, a known security question.

When in doubt, hang up and call back through a verified line. Anything urgent enough to justify a video transfer is urgent enough to justify a 60-second verification call.

Got a suspicious image or screenshot from a video call? Upload it to our scanner → scamsecuritycheck.com/scanner