Executive impersonation on video calls
How attackers impersonate executives, partners and vendors on video calls with cloned voices and live face swaps, what the cases have looked like, and how a meeting can be checked while it is still running.
<50ms
Detection during live meetings
<50ms
Detection during live meetings
3
Modalities: audio, image, video
4
Meeting platforms
99.7%
Audio detection accuracy
Enterprise meetings are the new attack surface. Attackers join Teams, Zoom, and Google Meet calls impersonating executives, partners, or vendors using cloned voices and real time face swap video. A convincing visual deepfake on camera, paired with synthetic audio, can fool even cautious participants. Raid AI integrates directly with your existing meeting platforms to detect both audio and video deepfakes in real time, covering every channel where impersonation can occur.
5 attacks being run against enterprise meetings today
These are not projections. Each one has already been used against organisations in this position.
| Attack | Method | Modality | Who it lands on |
|---|---|---|---|
| 1Face swap video impersonation | Attackers use real time face swap tools to visually impersonate executives on camera during live meetings. Combined with cloned audio, the deception is nearly indistinguishable from the real person, enabling fraud, data theft, and unauthorised decision making. |
| Who it lands on: Executives, finance staff |
| 2Cross platform voice impersonation | Attackers join legitimate meetings with cloned voices of absent executives. By the time participants realise something is off, sensitive information has already been exposed or decisions made. |
| Who it lands on: Meeting participants |
| 3Vendor and partner impersonation | Deepfake audio and video are used to impersonate trusted vendors during procurement calls, redirecting payments or extracting confidential pricing, contract, and product information. |
| Who it lands on: Procurement teams |
| 4Board and investor call attacks | Board meetings, investor updates, and M&A calls are high value targets. A deepfake participant can gather material non-public information or influence decisions during the call itself. |
| Who it lands on: Boards, investors |
| 5Internal team impersonation | In large distributed organisations, employees cannot always visually confirm every colleague on a call. Attackers exploit this by impersonating team members to extract credentials or direct payment flows. |
| Who it lands on: Distributed teams |
Where it has already happened
Reported cases, each written up with its sources.
How Raid AI answers it
Real time face swap detection
Analyse video feeds participant by participant to identify face swap artifacts, synthetic facial movements, and generative inconsistencies. Flag impersonators before they can influence the meeting outcome.
Joins the call as a participant
Raid AI joins Microsoft Teams, Zoom, Google Meet and Webex meetings as a participant and scores every stream while the conversation runs. Nothing to install on the meeting platform.
- Follows the calendar
- Native integrations with Microsoft Teams, Zoom, Google Meet, Slack, Webex, and WhatsApp
- Visual deepfake detection that identifies face swaps and synthetic video during live meetings
- Continuous monitoring of every audio channel in a meeting, not just one speaker at a time
- Real time overlay UI showing which participants have been verified as authentic across both audio and video
- Automatic alerting to meeting hosts and security operations centres when deepfake audio or video is detected
- Compatible with both cloud and on premise deployments of enterprise collaboration platforms
What this looks like on a normal day
Composite situations drawn from the pattern of reported attacks, not accounts of named customers.
Illustrative scenario
Executive impersonation in quarterly business review
A sales director joins a quarterly business review in place of a travelling CEO. Raid AI, running on the Teams call, flags the voice as cloned in under 50 ms, alerting the security team in real time.
Illustrative scenario
Vendor deepfake in procurement negotiation
During a Zoom procurement call, a cloned vendor voice attempts to redirect payment to a new bank account. The Raid AI Zoom app flags the deepfake, and the procurement team verifies through a second channel before committing.
Built for environments where security is not negotiable
From air gapped networks to strict data residency rules.
Retention you control
You choose how long media is kept. With zero retention, media is analysed and discarded once the verdict is returned and nothing is written to Raid AI storage. Otherwise media is kept for a window you set, 30 days by default, and then deleted. None of it is used to train a model, and enterprise tenants can keep their records inside their own database or infrastructure instead. Media goes only to the detection engines your tenant is configured to use, and only to produce the verdict.
Runs in your infrastructure
For air gapped and sovereign environments, the full detection stack runs inside your own network with no external connectivity.
TLS 1.3 encryption
All communication with the cloud API is encrypted using TLS 1.3. Media is protected from the moment it leaves your network.
Scoped API keys
Every integration is gated by a scoped key with configurable rate limits and IP allowlisting. Keys can be rotated at any time.
SOC 2 principles
Built around the five SOC 2 trust service criteria: security, availability, processing integrity, confidentiality and privacy.
Regional deployment
Cloud customers choose the region where their requests are processed. Media never leaves a specified jurisdiction.
Defence in depth
Infrastructure, application and model layers are each protected independently. A compromise at one layer does not expose customer data.
Audit logging
Every API call is written to a tamper evident audit trail, so you can reconstruct exactly what was processed, when, and by which key.
