A person on a video call looks like someone your staff knows and asks for an urgent change to a payment, an account or a shared file. What should the employee do next?
The safest working procedure is to verify consequential requests through an independent, established channel and follow the normal approval process. A familiar face, voice or display name should not authorize a payment or a change in access.
External video call security has two separate decisions: who may enter the meeting, and what a participant is allowed to ask the organization to do. Good meeting controls help with admission. Business verification and approval controls govern the request.
Use the current risk without turning every call into a crisis
In its September 17, 2026 public service announcement, the FBI described fraud involving impersonation of law-enforcement and government officials, including the use of video and AI-generated material. Its guidance emphasizes independently verifying claimed identities and avoiding contact details supplied by the suspected impersonator.
The useful lesson for a workplace is procedural. Staff should have a reliable way to pause a request and reach the real person or organization. They should not have to decide, from a compressed video image, whether a face looks sufficiently convincing.
Legitimate customers, partners and public participants still need to meet with your team. Build controls around the type of meeting and the consequence of the request, so ordinary collaboration remains practical.
Decide who manages admission
Assign an organizer or co-organizer to manage the lobby for meetings that need controlled admission. Give that person an expected attendee list and a way to resolve unfamiliar names before admitting someone. Avoid making everyone a presenter simply because it is convenient.
Check the settings in the platform your organization uses. Microsoft’s Teams lobby guidance, for example, explains controls for who can bypass the lobby and who can admit participants. Available choices can depend on administrative policies and the meeting configuration.
Test the intended behavior with approved external accounts and the joining methods your guests use. Include browser participation, mobile devices and dial-in where those are supported and relevant. An organizer’s internal-account test will not reveal every external participant’s experience.
For a public session, access requirements may differ from a confidential vendor discussion. Establish the appropriate meeting format and moderation process in advance. A blanket restriction that prevents the intended audience from attending is not a successful design.
Separate recognition from authorization
A calendar invitation, recognizable display name or admitted meeting account is useful context. None should replace the organization’s controls for payments, sensitive information or account changes. Even an expected participant may be using a compromised account, or may be asking for something outside their authority.
Define which requests require independent verification. Common examples include a new bank account for an invoice, an urgent transfer, a password reset, remote-control access, a new administrator, or the release of customer or employee information.
Use a contact route already held in the organization’s trusted records or independently obtained from the real organization. Do not rely on the phone number, link or email address supplied during the questionable call. Ask the responsible business owner to verify both the requester and the requested change.
Then complete the usual approval process. Reaching the real person does not eliminate requirements for a second approver, a purchase record or an access review. Those controls are valuable even when the request is legitimate.
| Request | Next step | Responsible team |
|---|---|---|
| Change payment destination | Pause the change, verify through the established vendor-contact process and obtain required approvals | Finance and the vendor owner |
| Share sensitive records | Confirm identity, authority, purpose and the approved transfer method | Data owner and appropriate privacy or security staff |
| Grant remote control or elevated access | Use the approved support request and access process | IT or security |
| Provide a password, MFA code or recovery code | Decline the request and contact the help desk through a trusted route | IT or security |
| Move urgently to an unfamiliar channel | Confirm the reason and destination independently before continuing sensitive work | Meeting owner |
Give employees a sentence they can use
Staff should be able to say, “I need to verify this through our usual contact and approval process before I make that change.” Make that a normal part of the workflow, including when the caller claims to be an executive, customer or government official.
Managers need to support the pause. If employees are criticized for slowing an urgent request, the written procedure will be difficult to use. Agree on a rapid escalation path for legitimate time-sensitive work so verification does not depend on finding one person who is out of the office.
Keep the procedure accessible during the call. A short help-desk entry with the trusted contact route, escalation owner and required evidence is more useful than a lengthy policy employees cannot find.
Avoid training that depends mainly on spotting visual glitches or unusual speech. Those signs may prompt caution, but ordinary connection problems can produce them too. The verification process should work even when the video and audio appear normal.
Review sharing and control permissions
Set screen-sharing, presenter and remote-control permissions according to the meeting’s purpose and the platform’s supported options. An external participant attending a status meeting may not need to control a workstation or present content to everyone.
Use the organization’s approved support tools when remote assistance is required. Keep that work tied to a service request and an authorized technician. A new support link introduced during an unexpected call should go through verification before anyone opens it or installs software.
Review recording, transcription and meeting-assistant participation as well. Our AI meeting-agent governance guide covers questions about who may introduce those tools and what information they can receive. Participants need a clear way to identify and challenge an unexpected attendee or assistant.
Make the reporting path easy
If a call becomes suspicious, pause the requested action and contact the internal security or support team through an established route. Preserve relevant invitations, messages, timestamps and other evidence according to the organization’s incident procedures. Do not continue interacting merely to investigate the caller.
If money, credentials or sensitive information has already been involved, tell the incident owner promptly so the appropriate finance, account-security or privacy response can begin. Staff should not delay reporting because they are embarrassed or uncertain whether the call was fraudulent.
The FBI’s Internet Crime Complaint Center accepts reports of suspected internet crime. Follow your organization’s incident process for reporting and any required notifications.
Rehearse a request, not a deepfake demonstration
Run a short tabletop exercise with a clearly fictional scenario: an expected vendor contact joins a meeting and asks to change a payment destination. Ask who pauses the request, where the trusted contact information lives, who verifies the change and what evidence is retained.
Repeat with an access request to the help desk. The exercise should reveal missing contacts, unclear authority or a process that takes too long for staff to follow. Fix those gaps and make the instructions easy to retrieve.
VIcom can help review the video collaboration environment and meeting workflows your team uses. Bring the common external-meeting scenarios and the admission, sharing and support controls you want to validate.
Connect with VIcom by filling out the form below.