How Can Real-Time Video Deepfakes Be Detected?
A real-time video deepfake is generated while the call or capture is happening. The attacker runs a face-swap or reenactment model on their own webcam feed and routes the output through a virtual camera, so the meeting app or onboarding SDK receives the fake as if it came from a normal camera. Detection has to keep pace: it samples frames or short clips from the stream, analyses them, and returns a score while the session is still open.
Effective systems combine three layers. Content analysis scores sampled frames for face manipulation, generator traces and texture that cameras do not produce. Capture-path analysis asks whether the video came from a physical camera at all, looking for virtual camera drivers, emulators and other signs of injection. Interaction checks ask the user to turn their head, move a hand across the face or change lighting, because live face models break down under occlusion and extreme angles.
| Layer | What it checks | Catches | Misses |
|---|---|---|---|
| Frame-level deepfake scoring | Face manipulation, generator traces, texture, blending | Live face swaps and reenactment | Heavily compressed or very low-resolution frames |
| Temporal analysis | Identity drift, flicker, motion and lip-sync over a short clip | Swaps that look fine frame by frame | Very short sessions |
| Capture-path checks | Virtual cameras, emulators, injected streams | Injection attacks that bypass the camera | Fakes shown to a real camera on a screen |
| Live challenges | Head turns, hand occlusion, lighting changes | Swaps that fail at profile or under occlusion | Well-trained models; adds user friction |
| Out-of-band confirmation | Callback, second approver, payment hold | Any impersonation regardless of video quality | Nothing about the media itself |
Do Deepfake Detectors Work on Live Video Calls?
Yes, with limits that matter. Detectors that score individual frames can run on a live stream, and short sequences give them temporal evidence a single photo lacks. But conferencing apps compress video aggressively, drop resolution when bandwidth falls and lose packets, which removes the fine traces detectors depend on and creates glitches in genuine calls. Deepfake-Eval-2024 (arXiv 2503.02857), built from deepfakes that circulated in 2024, found open-source detectors lost about 50% of their AUC on video compared with earlier benchmarks.
Where the detector sits matters as much as the model. Inside an onboarding or video KYC flow, the organization controls the capture SDK and can analyse frames before compression and check the camera path. On a third-party meeting platform, detection usually sees only the delivered stream or a recording, so confidence is lower and procedural controls carry more weight.
Where Are Real-Time Video Deepfakes Used Against Organizations?
The Arup case of January 2024 is the reference incident. A Hong Kong finance employee joined a video call with what appeared to be the company's chief financial officer and other colleagues; police said every other participant was a deepfake recreation. The employee made 15 transfers totalling HK$200 million, about US$25.6 million, and Arup confirmed to CNN in May 2024 that fake voices and images were used.
Remote hiring and identity checks are the other common targets. The FBI's Internet Crime Complaint Center warned on 28 June 2022 that applicants used deepfakes in remote job interviews, with lip movements and coughs out of step with the audio, and its 3 December 2024 announcement listed real-time video chats impersonating executives, law enforcement and other authorities. In onboarding, live swaps are paired with injection so the fake face passes liveness checks that only look for printed photos or screens.
What Latency Does Real-Time Deepfake Detection Need?
The budget depends on the workflow. In onboarding, a selfie or short video capture should be scored within the second or two a user will wait, so per-request latency in the low hundreds of milliseconds is the practical target. On a live call, the system can sample a frame every few seconds and build confidence over time, so per-frame latency matters less than steady throughput across many concurrent sessions.
Published figures vary widely. VendorBench-100 v2 reported mean latency on still images, in its own test setup, of 175 ms for Neural Defend, 1.1 s for Sightengine, 1.7 s for Hive, 5.3 s for TruthScan and 21.9 s for Reality Defender; the paper notes latency is not comparable across its tracks. Ask vendors for p95 latency under your expected load and media sizes, not a single average.
Can Real-Time Detection Be Fully Automated, and How Often Must It Be Updated?
Low-risk decisions can be automated; high-risk ones should not rest on the detector alone. A typical policy passes low scores, steps up to a live challenge or second capture in the middle band, and sends high scores to human review or blocks the action. For payments, credential resets and hiring decisions, a person should confirm through a separate channel before anything irreversible happens.
Models need updating as generators change. New face-swap and text-to-video tools leave traces that older detectors may not have seen, so vendors should retrain regularly, test against newly released generators and report results by version. Organizations should log the model version, threshold and score with every decision so they can re-examine past cases after an update.
How Does Neural Defend Support Real-Time Video Deepfake Detection?
NeuroVerify is built for live capture in onboarding, video KYC and account recovery. One API request checks a face image, video or audio and returns a unified risk score with signal-level evidence from six signals, including Live Presence Verification, Face Manipulation Detection and AI Generative Model Analysis. Eligible image requests return in under 200 ms at p95 under defined test conditions. Mobile SDKs for Android, iOS and Flutter let the check run at the point of capture, and backend SDKs, a REST API and an MCP server cover server-side flows.
When a live session leaves a recording or flagged clip, NeuroDetect handles the follow-up: frame-level heatmaps, audio segments, an LLM-assisted summary linked to evidence and a forensic report with model version and uncertainty. NeuroCall (Beta) covers deepfake voices on phone calls. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876; one benchmark author also co-wrote the ARCAS 1B paper, and the results are public to rerun. Deployment options include managed cloud, private cloud or VPC, on premises and air-gapped.
Evidence boundary
Limitations
- Compression, low resolution and packet loss on live calls reduce detector confidence and create glitches in genuine video.
- Detection on third-party meeting platforms usually sees only the delivered stream, without capture-path signals.
- The <200 ms p95 figure applies to eligible NeuroVerify image requests under defined test conditions; video and long sessions take longer.
- VendorBench-100 measures still images only; it does not test live video, audio or injection attacks.
Source record
Sources and references
- CNNArup revealed as victim of $25 million deepfake scam involving Hong Kong employeePublished May 16, 2024. Verified October 19, 2026.
- FBI Internet Crime Complaint CenterDeepfakes and Stolen PII Utilized to Apply for Remote Work Positions (I-062822-PSA)Published June 28, 2022. Verified October 19, 2026.
- FBI Internet Crime Complaint CenterCriminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)Published December 3, 2024. Verified October 19, 2026.
- arXivDeepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024Published March 4, 2025. Verified October 19, 2026.
- arXivVendorBench-100: A Unified Cross-Paradigm Benchmark for Deepfake Image Detection (v2)Published July 29, 2026. Verified October 19, 2026.
- arXivBenchmarking Neural Defend ARCAS 1B: A Foundational Multimodal Deepfake Detection ModelPublished September 21, 2026. Verified October 19, 2026.
