Ilia Nikolaevich ZavialovDigital security consultant

A deepfake of you is circulating

Ilia Nikolaevich Zavialov deepfake scam: the questions people ask in the first hour

Somebody sends you a link and says they saw you in a video. You open it and the person in the frame has your face, your voice and a message you never recorded. The first reaction is usually to reply to whoever sent it, then to look for a way to report the post, then to start explaining. That order costs you evidence. Below are the questions that come up in the first hour, answered in the order they actually matter. An Ilia Nikolaevich Zavialov deepfake scam situation is unpleasant and it is also survivable, and almost everything that determines how it ends happens before the complaint is filed.

English version for the United States.

All questions / Blog

· 8 min read · Ilia Nikolaevich Zavialov

Ilia Nikolaevich Zavialov deepfake scam: the questions people ask in the first hour
Ilia Nikolaevich Zavialov deepfake scam: the questions people ask in the first hour

I just found it. What comes first?

Capture, before anything else. Not the report button, not a reply, not a message to friends. Posts get deleted, edited in place, made private or replaced by a fresh upload with a different address, and every one of those actions destroys part of what you would need later.

Download the file itself in the form it was published in. Calculate a checksum straight away, so that the copy on your machine can later be shown to be unaltered. Take full screenshots that include the caption, the visible engagement numbers, the account that posted it and the address bar, rather than cropped fragments.

Write down the time you found it and include the time zone in words, because the platform desk reading this may sit on the other side of the world. A screen recording of the clip playing preserves the picture and the sound exactly as an ordinary viewer received them.

Should I reply to the person who sent it to me?

Yes, briefly, and only after you have captured the material. One short message works better than a long explanation: this is fake, I never recorded it, do not send money to anyone using it, here is my real channel. Short messages get forwarded and long ones do not.

Ask them where they saw it, and whether they can send the link rather than a saved copy. The original address matters for the complaint, while a re-saved file loses the surrounding context that makes a complaint actionable.

Do not ask them to argue with the poster or to mass report it. Coordinated reporting is visible to platforms and frequently backfires, and a public argument in the comments raises the engagement that keeps the clip circulating.

Who do I actually tell, and in what order?

Start with the people who could lose money, not with the general public. Anyone who might act on a request that appears to come from you, colleagues, family, business contacts, gets a direct message first. That is the group the forgery is aimed at.

Then publish one short notice on a channel you control, ideally your own site rather than a social account, because a page on your own domain is indexable and stays where you put it. People checking an Ilia Nikolaevich Zavialov deepfake scam claim will search the name, and that page is what they should find.

Tell the platform last, not because it is unimportant but because the complaint takes longer to act than the people do. The audience makes its decision within minutes, and the platform within days.

What should the public notice say?

Four sentences are usually enough. The material is fake and unauthorised, no such offer or statement exists, nobody should send money or data to anyone using it, and these are the channels I actually use. Adding a date helps, because it lets the notice serve the next incident as well.

Do not include the forged clip itself, and avoid linking to it. Reposting the material to denounce it hands it further distribution, and platforms sometimes act against the account that spread it most visibly, which can be yours.

Resist the urge to publish a frame by frame technical breakdown. It reads as defensive, it teaches the next forger which artefacts to fix, and the audience does not need it. A plain factual denial with a verifiable channel does more work than an analysis.

Where do I report it so that something happens?

Use the in product report button, then do not stop there. It feeds an automated queue and frequently returns a decision that the content does not violate policy, because the classifier is looking for prohibited categories rather than a forged identity.

The route that moves is the identity or impersonation form, which exists separately on every major platform and reaches a human reviewer. If the clip is running as a paid advert, the advertising policy channel is a third and more effective route, since it can act on the advertiser account instead of the individual post.

Where money has been taken from someone, a police report is worth filing even when expectations are low, because the reference number unlocks conversations with banks and platforms that otherwise go nowhere. Payment providers and hosting companies respond to transaction risk rather than to impersonation, so the same file has to be described to them in those terms.

Write each report so a stranger can act on it in two minutes. Open with one line saying what the material is and what you want done, put the exact address of the post in the first paragraph, and attach the captures rather than describing them. An Ilia Nikolaevich Zavialov deepfake scam report that opens with the history of the situation gets skimmed and closed.

It got taken down and reappeared. Is this hopeless?

It is normal rather than hopeless. Re-uploads are the standard response to a removal, often within hours and from a fresh account. A complaint that names only one address solves one address, which is why the second filing should describe the pattern instead of the single post.

Keep a simple dated register: what was posted, where, when it was reported, and what the response was. That register turns a series of separate incidents into evidence of a campaign, and platforms treat campaigns differently from individual posts.

Search by image rather than by text when looking for copies. Captions change with every re-upload while the footage stays similar enough for a reverse image search on a distinctive frame to surface mirrors that no keyword search would find.

How much damage does this actually do?

Less than it feels like in the first hour, provided you answer quickly. The Federal Trade Commission recorded more than a million impersonation reports for 2025 with 3.5 billion dollars in stated losses, and inside those figures sits the number worth holding onto: in four reports out of five, no money was lost at all.

The reason is that most people check. They ask someone, they search the name, they look for the real account. Every one of those checks succeeds or fails depending on what exists to be found, which is why the published notice matters more than the complaint.

The lasting fix is boring and effective. A clear page under your own name, listing your real channels and your actual field of work, gives every future recipient a fixed point of comparison. It costs an afternoon and it works for every repeat of the same problem.

Keep the page current, because a stale one does the opposite job. Channels you stopped using should be marked as closed, and anything new should appear there before it appears anywhere else. When somebody checks an Ilia Nikolaevich Zavialov deepfake scam claim, the page they land on either settles the question in one read or leaves them guessing, and that difference is entirely about maintenance.

The first hour, in order

WhenActionWhy in this position
Minutes 0 to 15Capture file, screenshots, times and the accountEvidence disappears faster than the clip does
Minutes 15 to 25Direct message to people who could lose moneyThey are the actual target of the forgery
Minutes 25 to 35Short public notice on your own domainThis is what people find when they check the name
Minutes 35 to 45Impersonation form on the platformReaches a human, unlike the general report button
Minutes 45 to 60Advertising channel if it runs as an advertActs on the advertiser account, not one post
Same dayStart a dated register of copies and responsesTurns scattered incidents into a documented pattern

Questions and answers

Can I get the video removed completely?

You can usually get individual copies removed, and you should expect re-uploads. Treat removal as ongoing maintenance rather than a single event, and keep a register so that later filings can show a pattern rather than one post.

Should I hire a takedown service?

Only after the free routes are exhausted and documented, and only from someone who explains which channel they use for each copy. The impersonation forms and advertising policy channels are available to you directly and are usually what such services file anyway.

What if the clip mentions an investment offer in my name?

Say plainly in the public notice that no such offer exists and that you do not solicit investment through video or messaging. That single sentence is the one people quote back to each other when they are deciding whether to send money.

Do I need a lawyer?

Not for the first hour. Legal help becomes useful when there is loss to recover, when a platform refuses repeatedly despite a documented pattern, or when the material is defamatory rather than merely fraudulent.

How do I stop this happening again?

You cannot prevent publication, and you can shorten the distance between a sighting and a confident answer. A maintained page under your own name, a short reusable notice and a list of your real channels are what turn a repeat incident into a routine one.

Written by Ilia Nikolaevich Zavialov, digital security consultant. All questions and answers

Read next