During a video meeting, a finance employee sees and hears what appears to be the CIO asking for the employee's current MFA code to fix an urgent payroll issue. The meeting was started from an external account the employee has never seen before. What should the employee do FIRST?

Deepfake impersonation uses synthetic audio and video to make an attacker appear to be a trusted person in real time. Indicators here include an unfamiliar external meeting account, urgency, and a request for an authentication secret that no legitimate administrator needs. The correct response is out-of-band verification: end the interaction and contact the purported requester through an independently known channel, such as the directory phone number, before taking any action. Asking a personal question fails because attackers who build deepfakes routinely harvest public profiles, so the answer proves only that the attacker did research. Providing the code because the face and voice match treats visual and audio likeness as authentication, which is exactly what deepfakes defeat; an MFA code should never be shared with anyone. Asking for confirmation by email from the same external account keeps verification inside the channel the attacker already controls, so it adds no assurance. Exam caveat: deepfake questions reward process-based verification, not attempts to spot artifacts in the video, because detection by eye is unreliable. Operational check: report the meeting and account to the security team, confirm the MFA code was not disclosed, and reinforce a policy that sensitive requests are validated by callback to a directory number.