Video Call Impersonation Controls for Banking: Reviewing Sensitive Instructions Given on Video

Which Video Banking Instructions Attract Impersonation?

Video banking started as a convenience for account opening and advice. Many banks now accept service requests on video as well: changing a registered phone number or address, raising limits, adding a nominee, reactivating a locked account, or approving a large transfer for a customer who cannot visit a branch. Each of these changes who controls the account or where money can go, which makes the video channel a takeover route.

The attacker's aim is to look and sound like the customer for a few minutes. The FBI's public service announcement I-120324, published 3 December 2024, describes criminals generating video for real-time video chats with supposed company executives, law enforcement and other authority figures. The same tools work against a bank agent who is checking a customer's face against a file photo.

How Do Attackers Impersonate Customers on a Bank Video Call?

There are two technical routes. In a face swap or reenactment, software maps the target's face onto the attacker's in real time, so head turns and blinks follow the attacker's movements. In an injection attack, the attacker replaces the camera feed with a virtual camera that plays pre-generated or live-manipulated video, so the bank's app receives frames that never passed through a physical lens.

FinCEN's alert FIN-2024-Alert004 (13 November 2024) names both behaviours that betray these setups. It lists the use of a third-party webcam plugin during a live verification check as a red flag, and notes that attackers may claim repeated technical glitches or ask to change communication method during the check. Agents should treat a request to move from video to a phone call, or to a different app, as a reason to escalate rather than accommodate.

Video Call Impersonation Controls for Banking: The Review Sequence

Start by classifying the instruction, because that decides how much the video can be trusted to carry. Then verify the person, then confirm the instruction through a channel the attacker is less likely to control.

Agent training matters as much as tooling. RBI's KYC Direction for V-CIP requires officials to be specially trained to carry out liveness checks and spot suspicious conduct, and the same principle applies to service calls. Agents should know the FinCEN red flags, follow a written script that varies prompts, and have authority to end a session and move the request to another channel without penalty.

• Classify the request before identity questions start.
• Run the session inside the bank's own app or SDK rather than a third-party meeting link.
• Use varied, unpredictable prompts (read a random phrase, turn to a named side, hold up a stated number of fingers).
• Screen the video stream or captured frames for face manipulation and virtual camera signs, and compare the face with the onboarding record.
• Watch for prompting: another voice, eyes moving to a script, pauses before every answer.
• Confirm high-risk instructions in the bank app on a bound device or by callback to the number on file.

How Neural Defend NeuroVerify Screens Video Banking Sessions

NeuroVerify accepts a face image, video or audio and returns a unified risk score with signal-level evidence in a single API call. Its six signals cover Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. For a video banking session, frames or short clips can be scored during the call, giving the agent an alert while the customer is still on screen; eligible image requests complete in under 200 ms at p95 under defined test conditions.

The underlying ARCAS 1B model is described in a public arXiv paper that reports pooled accuracy between 97.65% (OpenFake) and 99.99% (GenImage) across six image benchmarks. Banks that must keep session data in country, as RBI requires for V-CIP recordings, can deploy NeuroVerify in a private cloud, on-premises or air-gapped. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II.

If a session is later disputed, NeuroDetect takes the recording into a case, shows frame-level explainability heatmaps and audio segments, and produces a downloadable forensic report for the investigator, who makes the final call.

How to Test Video Banking Controls Before Attackers Do

Run red-team sessions against your own channel. Use consenting staff as targets and try the attacks FinCEN describes: a face swap through a virtual camera, a replayed recording, a request to move channels mid-session, and a coached genuine customer. Record which control caught each attempt, and how long the agent took to escalate.

Measure the cost to real customers too. Track how often legitimate sessions are flagged, how many customers abandon after a second-channel confirmation, and whether particular devices, lighting conditions or age groups are flagged more often. Those numbers tell you where to adjust thresholds and prompts, and they give compliance teams evidence that the controls were tested rather than assumed.

What a Clean Video Score Does Not Prove

A low manipulation score says the video looks like a real, unaltered person. It does not prove the person is acting freely. A customer being coached by a scammer on another phone, or a relative pressuring an older customer off camera, passes every media check. Look for signs of prompting and, for critical instructions, rely on confirmation outside the call.

Keep a record for each sensitive instruction: request type and tier, session identifiers, the manipulation score and model version, agent observations, the second-channel confirmation and its source, and the final decision. In India, RBI requires V-CIP recordings and activity logs to be stored in systems located in the country with searchable date and time stamps; other jurisdictions have their own retention rules.