{"success":true,"data":{"id":"deepfake-video-call-follow-up-bec-email","label":"Deepfake video-call follow-up BEC email — post-call enforcement email \"confirming\" wire transfer discussed in a deepfake Teams/Zoom call, with inline routing numbers and confidentiality instructions. Mandiant Apr 2026; FBI IC3 2025 ($1.4B deepfake BEC); FinCEN 2026.","description":"A follow-up email sent after a deepfake video call (Teams, Zoom, Google Meet) impersonating a CFO, CEO, or senior executive, which \"confirms\" the wire transfer or credential change that the deepfake call instructed. The email references the call (\"as we discussed on today's call\"), provides bank account wire details or routing numbers inline, and includes confidentiality instructions to prevent the victim from verifying with colleagues. This is entirely distinct from existing deepfake signals that detect emails initiating or delivering deepfake content — this detects the post-call enforcement email. Mandiant's April 2026 Threat Intelligence report documents this two-stage model; the FBI IC3 2025 Annual Report identifies it as responsible for 34% of all deepfake-BEC incidents, totaling $1.4B in 2025 losses.","tier":"warning","category":"scam","isThin":false}}