Skip to main content

Deepfake video calls on WhatsApp

Read How a deepfake video call runs first. This page covers only what is specific to WhatsApp.

WhatsApp is where executives actually do business, which is why it is where executive impersonation actually happens. There is no calendar, no invite, and no IT department in the middle. A video call from a number saved as the chief executive, at an hour when a real one might plausibly come, is one of the highest-yield exercises in this section.

It is also the one with the most setup, and the setup has to be redone every time.

What you need before you launch​

  • A WhatsApp account, and the phone it belongs to, in the room with you. Not on the same network, not reachable later: in the room, unlocked, for the first minute of the session.
  • The target saved as a contact, or at least reachable. You are placing a one-to-one call to a person, not joining a meeting.
  • A decision about whose account this is, which matters more here than anywhere else in this section. The number is the identity: it is what the target's phone shows before they answer, and it is what they will screenshot afterwards. Use an account the exercise controls, and record which one in the campaign.

There is no meeting details field for WhatsApp. There is nothing to paste.

Linking the device​

The session opens WhatsApp's web client, which is not signed in and cannot be. You link it from your phone, by scanning what is on screen.

WhatsApp

Screens captured 25 August 2026
WhatsApp: pair your phone, as the operator sees it

Pair your phone

On your phone, open WhatsApp, go to Settings then Linked Devices, tap Link a Device, and scan this code. The code refreshes, so scan the one on screen.

Alternative: "Log in with phone number" gives you a typed code instead, if the camera route fails.

⚠ The code on screen rotates. Scan the one you are looking at. A code from a screenshot taken a minute ago will not work, and this is the commonest way the first attempt fails.

This is the fact that shapes every WhatsApp exercise, and it surprises people who have linked WhatsApp Web on their own laptop and never thought about it again.

Each session is a new link, and it goes away when the session ends. The next exercise starts from an unlinked client and needs the phone again. So:

  • The phone has to be present for every run, not just the first one.
  • A rehearsal does not save you setup on the day. It saves you surprises, which is worth more.
  • If a session dies mid-exercise, restarting costs the provisioning wait plus the link again. On a channel where the target is a person waiting for a call, that is usually the end of the attempt rather than a retry.

Budget the link into your timings alongside the wait, and do it while the voice and face are being configured rather than after.

Making the call​

Open the conversation with the target and start a video call. There is no lobby, no waiting room and no admission: their phone rings, and the exercise has started.

Two things that are true here and nowhere else in this section:

  • The target is almost certainly on a phone, holding it, looking at a small vertical screen. A face that reads well on a laptop tile is being judged at a different size and a different angle. Frame the persona accordingly.
  • They can call you back. WhatsApp keeps the conversation, so a target who becomes suspicious after the call has a direct route to the number you used. Decide in advance who answers that, and what they say. This is a real part of the exercise design, not an edge case.

Disclosure on a personal channel​

WhatsApp is the channel where the debrief matters most and is hardest to control. The target has been called on a personal device, on a personal number, by someone impersonating a colleague.

Reveal deliberately, in the call, using the rail. Then follow it up in writing through a work channel the same day. A target who works out afterwards, on their own, that they were deceived on their personal phone will remember the exercise as something done to them. See AI Act compliance.

What goes wrong​

The scan fails. The code rotated. Look at the screen, not at a photograph of it.

The client is linked but shows no conversations. The account has no history with the target, which is itself a signal the target may notice.

The call is not answered. Expected, frequently. Plan for it, and do not call three times: that is a different scenario from the one you designed.

The target answers and sees no video. The face swap is not running. See configuring the session.