A housing-authority IR playbook receives an urgent payment video that appears to show the director's face authorizing a same-day wire. What is the most appropriate first defensive response?

When a housing-authority incident-response playbook receives an urgent payment video that appears to show the director authorizing a same-day wire, the most appropriate first defensive response is out-of-band verification through a known-good channel before any funds move. Facial likeness no longer proves authenticity in a deepfake-capable threat environment. Pre-established callback numbers, authenticated finance workflows, dual-control release procedures, and confirmation with named contacts independent of the video are the controls that prevent fraudulent wires while preserving legitimate urgent operations when the request is real.

Immediately wiring funds because the face looks right treats likeness as proof and is exactly the failure mode deepfake payment social engineering exploits. Posting the video publicly for crowd validation can amplify a forgery, leak sensitive payment context, and create secondary disinformation without establishing authenticity. Disabling all video conferencing citywide until a forensic lab finishes is a disproportionate first move that harms municipal collaboration and does not answer the payment-authorization question in the moment.

Exam caveat: first-response items usually want the least disruptive verification step that stops irreversible harm—not public spectacle or citywide shutdowns. 'Verify out-of-band' is the standard high-value civic answer pattern for deepfake payment urgency.

Operational check for housing-authority finance and IR teams: freeze release on likeness-only video authorizations; call the director or deputy on a rostered number; require dual approval for same-day wires; document the artifact for later analysis; and update playbooks so facial appearance alone never satisfies payment authentication.