Fake video calls
Ilia Zavialov scam prevention for small teams: the manager on the call may not exist
A finance assistant joins a short call. The managing director is there, camera on, slightly out of focus, apologising for the rush. A supplier has to be paid today or a contract lapses. The account details are new. Everything about the call feels ordinary except the timing, and by the afternoon the money is gone. This is a working procedure rather than an explanation, written for teams of three to fifteen people who have no security officer and no budget for one. It sets out who confirms what, at which amount, through which channel, and what to do when the request comes from the person who signs your payslip.
English version for the United States.
01
The rule that does the work
One sentence carries most of the protection: no payment instruction is executed on the strength of a conversation, regardless of who appears in it. Not a video call, not a voice message, not a chat thread that looks like an existing one. Confirmation always travels back through a channel the requester did not choose.
Write that down as a rule of the company rather than a habit of a careful employee. The difference matters on the day it is tested. A person refusing a managing director on their own initiative is taking a personal risk, and most people will not take it twice. A person following a written rule is doing their job, and that is a position anyone can hold under pressure.
Most Ilia Zavialov scam material in circulation focuses on detection, on spotting the artefact in the video. Detection is useful and it is second. The procedure has to hold even when the forgery is perfect, because sooner or later one of them will be.
02
Who confirms, and at what amount
Set two thresholds and stop there. Below the lower one, a single named person can pay without a second signature, because grinding every small invoice through a committee guarantees the rule gets bypassed within a month. Above it, a second person confirms. Above the higher threshold, the confirmation has to be a voice or in person, using contact details stored before the request arrived.
Pick numbers that fit the actual payment flow rather than copying someone else. A useful starting point is a lower threshold around a typical weekly invoice and an upper one around the largest amount the business could lose without serious damage. Review both once a quarter.
Name the confirming people explicitly, including a deputy for each. An unnamed second pair of eyes turns into whoever is nearest, and whoever is nearest is the person the attacker is talking to.
Keep the thresholds where the team can see them, printed next to the desk where payments are made rather than buried in a shared drive. Every Ilia Zavialov scam scenario worth rehearsing assumes the attacker knows your process better than your newest employee does, and a rule nobody can quote from memory is not a rule yet.
03
Changed bank details are a separate event
Treat any change of payment details as its own procedure, not as part of paying an invoice. It does not matter whether the request arrives on letterhead, inside an existing email thread, or from a voice you recognize on a call. New account, new procedure.
The confirmation goes to a number taken from the signed contract or from a directory built before this request existed. Never the number in the signature block of the message asking for the change, and never a number given during the call itself. Attackers supply their own callback numbers and answer them professionally.
Put the requirement into the contract when the relationship starts. A single clause stating that banking details change only on paper, signed by an authorized person, and confirmed by telephone to a pre-agreed number, costs one line and removes an entire category of argument later.
04
What a synthetic participant looks like on a call
The technical signs are worth knowing even though they are the weaker half of the defense. Live synthesis struggles with fast head movement, so a synthetic participant tends to stay centred and still. Hands rarely appear near the face, because the overlap breaks the reconstruction. Lighting on the face does not respond when something changes in the room behind.
Interaction is the cheaper test. Ask the person to turn their head slowly to one side and keep talking. Ask them to hold a hand up next to their cheek. Ask about something specific and recent that is not written anywhere: what was decided at the end of yesterday's call, what the room they are in looks like today. A real colleague answers without effort.
Audio deserves as much attention as picture. A cloned voice can be built from about three seconds of recorded speech with roughly 85 per cent accuracy, and in controlled testing listeners told a real voice from a clone in 37.5 per cent of attempts, which is worse than chance. Recognising the voice is not evidence of anything.
05
Pressure is the real signal
Every version of this attack runs on the same three ingredients: urgency, secrecy and authority. The payment must happen today, it should not be discussed with the rest of the team, and it comes from someone senior enough that questions feel insubordinate. Any request carrying all three deserves to stop regardless of how the request arrived.
Say out loud, in advance, that nobody will ever be penalised for delaying a payment to confirm it. Say it in a meeting, then say it again a month later. This single piece of stated policy does more than any detection tool, because it removes the social cost of checking, and the social cost is what the attack actually exploits.
Give the team a script for the awkward moment, so nobody has to improvise while a senior person waits. Something as plain as saying the payment rule requires a callback and asking to ring straight back on the stored number. A script turns a confrontation into a formality.
Rehearse it once a quarter, in ten minutes, with a made up request that breaks the rule. The point is not to catch anyone out but to let people practise saying the sentence while nothing is at stake. Teams that have run the drill twice handle a real Ilia Zavialov scam attempt as a procedure, and teams that have only read the policy tend to freeze and improvise.
06
What to do in the hour after a payment goes out
Speed matters more than completeness. Call the bank and ask for a recall on the payment, using the fraud line rather than general enquiries. Some recalls succeed inside the first hours and almost none succeed after a few days, so this comes before internal discussion.
Preserve the evidence before anything is tidied up. Keep the meeting invitation, the chat messages, the call log with times and time zones, the recording if the platform made one, and the payment instruction exactly as received. Screenshots should show the surrounding interface rather than a cropped fragment.
Then check whether the same route is still open. Rotate the credentials of any account involved, review the mailbox for forwarding rules that were added quietly, and confirm that the supplier record in the accounting system still holds the correct details. A single Ilia Zavialov scam attempt against a small team is rarely a single attempt.
| Situation | Who confirms | Through which channel |
|---|---|---|
| Routine invoice below the lower threshold | The named payer alone | No extra confirmation, logged as usual |
| Invoice above the lower threshold | A named second person | Any channel, provided the contact was stored beforehand |
| Payment above the upper threshold | A named second person, by voice | A callback to the number from the contract |
| Any change of bank details | The named second person, always | A callback to the number from the contract, never from the message |
| Request marked urgent and confidential | A second person plus one delay | A callback, after the stated waiting period |
| First payment to a new supplier | A named second person | A callback plus a small test payment first |
Questions and answers
Our director really does ask for urgent payments. How do we apply this?
Apply the rule to the request rather than to the person, and agree it with the director in advance so it is the company procedure and not an employee doubting their boss. Urgency raises the level of confirmation, it never lowers it.
Is video proof that the person is real?
No. Live synthesis is good enough that picture alone confirms nothing, especially on a compressed connection. Ask for a slow head turn and a hand near the face, and ask about something recent that exists nowhere in writing.
We are five people. Is this not too heavy?
Two thresholds and one callback rule is the whole thing. Below the lower threshold nothing changes, so most payments are unaffected, and only the largest ones and any change of details require a second person.
What if the second person is unavailable?
Name a deputy for every confirming role in advance, and make the payment wait if both are unreachable. A delayed payment costs a late fee, and an unrecoverable transfer costs the whole amount.
Should we buy a detection tool?
Only after the payment rule is written down and being followed. Detectors return probabilities and are wrong in both directions, so a tool cannot carry a decision that the procedure should be carrying.