Ofcom reported in its 2024 Online Nation report that 97 percent of UK adults use the internet. That reach creates a simple security problem: a convincing synthetic face or voice can now enter an ordinary Teams, Zoom or Google Meet call without raising immediate suspicion. Real time deepfake detection for video calls can help, but it isn’t a magic identity check.
The sensible approach combines live detection with strong payment controls, identity verification, staff training and a clear escalation route. Treat the software as a warning system, not as proof that a caller is genuine.
What real time deepfake detection for video calls does
Detection tools analyse a live video stream while a call is taking place. Depending on the product, they may examine facial movement, skin texture, lighting changes, lip synchronisation, frame-level artefacts, camera behaviour and audio-video alignment.
Some systems run inside the browser or video-conferencing application. Others capture a feed through an integration, virtual camera or security platform. The result might be a risk score, a coloured warning, a confidence percentage or an alert for a security team.
That distinction matters. A detector doesn’t usually identify the person behind the screen. It assesses whether the media behaves like authentic camera and microphone output. A real employee using a poor webcam can trigger an alert, while a carefully prepared synthetic stream may pass for longer than expected.
Why live calls are harder than uploaded videos
Live detection has less data to work with. A recorded clip can be paused, enhanced and checked repeatedly. During a call, the system has to make a decision despite packet loss, compression, changing light, background noise and a face that may turn away from the camera.
Latency is another trade-off. A detector that waits several seconds for more evidence may be more accurate, but it can make a normal conversation awkward. A system that produces instant alerts may generate more false positives.
How real time deepfake detection for video calls works
Most products use several signals rather than one visual trick. That is sensible because obvious signs such as blinking or strange teeth are no longer reliable on their own.
- Facial geometry: the software checks whether eyes, mouth, jaw and head movement remain physically consistent across frames.
- Temporal consistency: it looks for sudden changes in texture, identity features or lighting that don’t fit a continuous camera feed.
- Lip and voice alignment: it compares speech timing with mouth movement and may flag a mismatch.
- Capture artefacts: it examines compression patterns, frame rates, virtual-camera signatures and unusual rendering behaviour.
- Challenge responses: a participant may be asked to turn their head, read a phrase or follow an on-screen instruction.
- Context signals: some platforms combine media analysis with device, account, location and session information.
These methods are probabilistic. They estimate risk; they don’t provide a courtroom-grade certificate of authenticity. The strongest systems also explain why they raised an alert, which makes an incident easier to investigate.
If the suspected attack includes a cloned voice, pair video analysis with the practical checks in this guide to spotting deepfake audio in meetings. A believable face and a believable voice can arrive together.
Where the technology works and where it fails
Real time deepfake detection for video calls is most useful during high-value, high-pressure interactions: a finance director approving a bank transfer, a senior executive requesting confidential documents, or a supplier changing payment details.
It is less reliable when the call has poor connectivity, participants use virtual backgrounds, cameras are disabled or the video is heavily compressed. Strong backlighting, low resolution and screen sharing can remove the very signals the detector needs.
| Control | What it can detect or prevent | Main limitation |
|---|---|---|
| Live media detection | Suspicious facial, audio or video behaviour during a call | Can miss new attack methods and produce false positives |
| Challenge response | Some replay, avatar and pre-recorded video attacks | Can be inconvenient and may not stop a skilled impersonator |
| Independent call-back | Requests made by an impersonator using a compromised meeting | Fails if staff use contact details supplied during the call |
| Payment approval policy | Unauthorised transfers and account changes | Requires staff to follow the process under pressure |
| Identity and device checks | Unusual logins, devices or account behaviour | A genuine compromised account may still appear credible |
The lesson is straightforward: detection should sit inside a control set. A red warning on screen is useful. It isn’t a substitute for calling the person back on a known number.
For a wider view of impersonation tactics, read how deepfake scams work in businesses. It covers the social engineering around the media, which is often more damaging than the synthetic clip itself.
How to use live detection in a UK organisation
Start with risk, not software. List the decisions that must never be made from a single video call. These normally include payments, payroll changes, access to customer data, privileged account resets and urgent requests for secrecy.
A practical operating process
- Set a trigger. A detection warning, unusual request or sudden change in behaviour should require a second channel check.
- Use a known contact route. End the call and contact the person through the number in your internal directory, not a number typed into the chat.
- Require two people. One person should not approve a payment or amend bank details because a senior colleague appeared on camera.
- Record the evidence. Keep the meeting time, participant details, alerts, chat messages and relevant screenshots in line with your retention policy.
- Escalate quickly. Tell the bank, platform, police or cyber insurer when the facts justify it. Time matters in payment fraud.
Run exercises with realistic pressure. Ask an employee to join from an unfamiliar account, create an urgent request and refuse a call-back. Staff need to practise the pause, not merely hear that deepfakes exist.
Need help reviewing your call verification process? Speak with our team about a practical deepfake risk review.
Privacy, consent and UK regulatory duties
Live detection can involve biometric data, recordings, device information and behavioural signals. Under UK GDPR, biometric data used to uniquely identify a person is special category data. An organisation needs a lawful basis and, where applicable, an Article 9 condition, plus clear information for participants.
Don’t record every call simply because a detector is available. Define the purpose, minimise the data, set retention periods and restrict access. The Information Commissioner’s Office guidance on data protection and artificial intelligence is the right starting point for a data protection impact assessment.
There is also a consent issue. A face or voice may have been captured lawfully for one purpose and then reused to train or operate a detection system for another. Explain what is being analysed, whether a vendor receives the stream, where processing occurs and what happens when the system makes a mistake.
UK online safety regulation adds another layer for platforms and relevant services. Ofcom’s illegal harms regime, introduced under the Online Safety Act, expects regulated services to assess and reduce specified risks, including fraud-related harms. Ofcom published its illegal harms codes and risk-assessment materials in 2024; the Ofcom online safety guidance should be checked for the duties that apply to your service.
This is not a promise of legal certainty. The right obligations depend on your role, processing, sector and the people affected. The ICO’s 2023 consultation on generative artificial intelligence also underlined that existing data protection principles still apply when organisations develop or use generative systems. Keep a written record of the reasoning behind your safeguards.
A useful UK precedent is the 2023 High Court injunction obtained by actress and model Kelly Cutrone against the distribution of sexually explicit deepfake images. It showed how seriously courts can treat misuse of a person’s likeness, but it also showed why prevention is preferable to trying to remove material after publication. For consent and image rights, see the UK guide to making deepfakes without consent.
How to assess a detection vendor
Ask vendors for evidence, not polished demonstrations. Request performance results on live calls with different cameras, lighting conditions, accents, bandwidth levels and attack types. Find out whether the testing set included unfamiliar synthetic media rather than only the examples used to train the model.
- What is the average alert delay?
- How often does the system flag genuine calls?
- Can attackers route a synthetic feed through a virtual camera?
- Does the product inspect audio as well as video?
- Where are streams and derived data processed?
- Can administrators export an audit trail?
- What happens when the detector is unavailable?
- Does the vendor allow independent testing and incident notification?
Ask for a clear explanation of confidence scores. A score of 92 percent does not mean there is a 92 percent chance that the person is an impostor unless the vendor has defined and validated it in that way. Numbers without calibration encourage false confidence.
For provenance, consider whether the platform supports the C2PA content provenance standard. Provenance can help establish how media was created or edited, although missing provenance does not prove that a video is fake.
A sensible control plan for the next 30 days
Week one: identify the five call scenarios where an impersonation would cause the greatest harm. Document who can approve the action, which independent channel confirms it and what evidence must be retained.
Week two: test your current meeting platform. Disable automatic trust in caller identity, review guest settings, restrict screen sharing where appropriate and confirm that staff can report suspicious calls without delay.
Week three: run a controlled simulation. Test genuine calls as well as synthetic examples, because a security control that blocks legitimate customers will be bypassed.
Week four: decide whether you need real time deepfake detection for video calls, a broader identity platform or simply better approval discipline. Often the best first investment is an independent call-back rule that costs almost nothing.
Keep the system under review. Attackers adapt, vendors update models and your own meeting habits change. The quiet contrarian view is that a detector is valuable only when it makes people slow down before money, access or sensitive information changes hands.
If you want a second opinion on priorities, arrange a confidential conversation about your organisation’s synthetic-media controls.
FAQs
Can real time deepfake detection for video calls guarantee that a caller is genuine?
No. It can identify signals associated with manipulated or synthetic media, but it cannot prove a person’s identity. Use it with independent call-backs, multi-person approval and account security checks. A genuine employee using a poor connection can also trigger an alert, so every result needs sensible human review.
Do small businesses need real time deepfake detection for video calls?
Not every small business needs specialist software. If staff approve payments or handle sensitive records remotely, start with a known-number call-back, two-person approval and staff exercises. Consider a detector when the likely loss is high, attacks are recurring or customers need identity assurance during live interactions.
Is recording a video call for deepfake detection lawful in the UK?
It may be lawful, but the answer depends on purpose, lawful basis, transparency, retention and the data being processed. Biometric identification can involve special category data under UK GDPR. Carry out a data protection impact assessment where the processing is likely to create high risk and obtain specialist advice for unusual deployments.
What should an employee do if a video caller requests an urgent payment?
Pause the request. End the call, contact the colleague through a trusted internal number and follow the normal approval process. Do not use contact details provided in the meeting chat. If money has moved, contact the bank immediately, preserve evidence and report the incident through your organisation’s cyber incident route.
Frequently asked questions
Can real time deepfake detection for video calls guarantee that a caller is genuine?
No. It can identify signals associated with manipulated or synthetic media, but it cannot prove a person’s identity. Use it with independent call-backs, multi-person approval and account security checks. A genuine employee using a poor connection can also trigger an alert, so every result needs sensible human review.
Do small businesses need real time deepfake detection for video calls?
Not every small business needs specialist software. If staff approve payments or handle sensitive records remotely, start with a known-number call-back, two-person approval and staff exercises. Consider a detector when the likely loss is high, attacks are recurring or customers need identity assurance during live interactions.
Is recording a video call for deepfake detection lawful in the UK?
It may be lawful, but the answer depends on purpose, lawful basis, transparency, retention and the data being processed. Biometric identification can involve special category data under UK GDPR. Carry out a data protection impact assessment where the processing is likely to create high risk and obtain specialist advice for unusual deployments.
What should an employee do if a video caller requests an urgent payment?
Pause the request. End the call, contact the colleague through a trusted internal number and follow the normal approval process. Do not use contact details provided in the meeting chat. If money has moved, contact the bank immediately, preserve evidence and report the incident through your organisation’s cyber incident route.
