Skip to main content

Deepfake video calls on Signal

Read How a deepfake video call runs first. This page covers only what is specific to Signal.

Signal is the channel to use when your target is the person who would never fall for the others. Security-conscious employees, executives briefed on phishing, and engineers who treat email as hostile all tend to treat Signal as the safe channel, and safe is a synonym for unexamined. An exercise that succeeds on Signal tells you something no email test ever will.

It is also the least forgiving channel here, for one specific reason.

What you need before you launch​

  • A Signal account, and the phone it belongs to, in the room. This is not negotiable on Signal in a way it is not quite true of the others.
  • The target reachable on Signal. They must have the account you are calling from, and they must have Signal installed and registered.
  • A decision about whose account this is, and on Signal that decision is unusually narrow. Signal identity is bound to a phone number, and the number is what the target sees.

There is no meeting details field for Signal. There is nothing to paste.

Linking the device​

Signal's desktop client cannot sign in on its own. The only way to make it usable is to link it as a device from the phone app, under its own device settings.

Signal

Screens captured 25 August 2026
Signal: pair your phone, as the operator sees it

Pair your phone

On your phone, open Signal, go to Settings then Linked Devices, tap Link a New Device, and scan this code.

Alternative: Signal has no phone-number fallback here. The device must be linked from the phone app.

There is no second way in​

Every other paired channel here has an escape hatch. WhatsApp offers a typed code as an alternative to the camera. Telegram offers a whole sign-in by phone number. Signal offers neither. If the linking will not go through, the exercise does not happen in that session.

That single fact should change how you run a Signal exercise:

  • Rehearse the link once, on a throwaway session, before the exercise. On this channel it is worth spending a session to find out that it works.
  • Have the phone unlocked and the app already open at the device settings screen before the session finishes provisioning, so the link is the fastest part rather than the part you are fumbling.
  • Treat a failed link as a reschedule, not as something to keep retrying while a target waits.

As with the other paired channels, the link does not persist: every session starts from an unlinked client.

Making the call​

Open the conversation and start a video call. The target's phone rings, and answering puts them straight into the call.

What is different about a Signal exercise:

  • The channel is doing pretext work for you. A target who trusts Signal specifically because it is encrypted may extend that trust to the person on it, which is a confusion worth naming explicitly in the debrief. Encryption protects the pipe. It says nothing about who is at the other end, and that gap is exactly what this exercise demonstrates.
  • Signal shows very little. No corporate directory, no profile beyond what the account sets, no organisational context at all. The face and the voice are carrying almost the whole impersonation, which makes this the purest test of them in this section.
  • The target may have message disappearing turned on. Anything you rely on as evidence for the debrief should be captured during the exercise, not looked for afterwards.

Disclosure, and why it is sharper here​

Reveal in the call, using the rail, and follow up the same day through a work channel.

The care needed here is higher than on any other channel in this section. You have used the tool your target chose specifically because they were being careful, and the lesson lands hard by design. That is the value, and it is also the reason to have the debrief written before the call rather than improvised after it. See AI Act compliance.

What goes wrong​

The link will not complete. There is no fallback. Reschedule.

The target is not on Signal. They have to be registered. Confirm it before the exercise; there is no way to reach a non-user.

The call connects with no video. The face swap is not running. See configuring the session.

The target declines and messages instead. A common and interesting outcome on this channel, where a cautious target moves to text to verify. Record it: refusing a call to verify by another route is the behaviour you were hoping to see.