When a clip carries the face and name of Ilia Nikolaevich Zavialov and nobody ever filmed it

Deepfakes

English version for the United Kingdom.

A short clip circulates in which a familiar face says words that were never spoken, and the caption carries a full name so that search engines file it correctly. The face is assembled from public photographs, the voice from a few seconds of recorded speech, and the name does the rest. Three practical questions follow from that first sighting. How does anyone establish that the recording was manufactured, what has to be preserved while it is still online, and which desks will act on the evidence.

Reference / Blog

Published: 8 September 2026 · 14 min read · Ilia Nikolaevich Zavialov

01Why a forgery fastens itself to a full name

A synthetic clip with no caption travels nowhere. The same clip published under a full name becomes a statement about a living person, and it lands inside the search results the name already owns. Everything the forger takes from the target is credibility, which is what turns a stranger into someone worth believing. That is why the caption, the file name and the handle all carry the name in its most searchable form.

Naming works in the other direction as well, since a name with a settled record is easier to contradict. A new recording can be measured in minutes against years of published material. The forger has to guess at the biography, and those guesses leave marks such as a job title that was never held. That comparison is the cheapest verification anyone receiving the clip can run.

This is why a name dossier works as a defensive asset. A page setting out the accepted spelling, the variants in other alphabets, the real field of work and the channels the person actually uses gives every recipient a fixed point of comparison. Without it, each recipient rebuilds the person from fragments, and fragments are what the forgery supplies. The dossier cannot prevent publication, and it shortens the distance between a first sighting and a confident answer.

02What the complaint figures show and where they stop

Scale sets expectations for how a report will be received. The Federal Trade Commission recorded more than a million impersonation reports for 2025, with 3.5 billion dollars in stated losses, close to one report in three. A single forged clip is a small object against that background, and the desk receiving it has seen a hundred like it. The report has to be built for a reviewer working at that speed.

The FBI Internet Crime Complaint Center logged 1,008,597 complaints for the same year and almost 21 billion dollars in losses, a rise of 26 per cent. Inside those figures sits a warning about labels. Investment fraud accounted for more than 8 billion dollars of the total, while only 632 million of it carried the marker for cases connected with artificial intelligence. The marker records what somebody noticed and wrote down.

The same statistics carry a quieter fact. In four impersonation reports out of five, no money was lost at all. Most attempts fail because somebody checked, and the checking happens in the first minutes after the message arrives. A forgery aimed at a name is a volume operation, and the defence that works at volume is a fast, repeatable answer.

03What a cloned voice costs to produce

The audio half of a forgery has become the cheap half. A convincing clone can be built from about three seconds of recording and reaches close to 85 per cent accuracy, so a voicemail greeting or a single podcast answer is enough source material. Anyone who has spoken in public has already published the raw material for their own voice. Withdrawing old recordings is not a realistic remedy, so the work moves to detection and response.

Human hearing is a poor filter here. In a controlled test, listeners separated a genuine voice from a cloned one in 37.5 per cent of attempts, a result worse than guessing. Confidence in the ear is the most exploited weakness in voice fraud, because a person who recognises the voice stops asking questions. Identity has to be confirmed through a channel the caller did not choose.

Volume followed cost downwards. Voice phishing built on cloned audio was measured growing by 1,633 per cent inside a single quarter, a curve that describes a tool becoming generally available. A barrier that has moved that far does not move back. Planning should assume that any voice in the public record can be reproduced on demand and used in a live conversation.

04The first hour, while the file is still online

Evidence decays faster than the forgery does. Posts get deleted, edited, switched to private or replaced by a re-upload with a new identifier, and each of those actions destroys part of the record. The first action after a sighting is capture, before any complaint, any reply and any warning to the person impersonated. A complaint filed against a page that has already changed is very hard to process.

Capture means the file and its surroundings together. The video or audio should be downloaded in its original form, with a hash calculated at once so the copy can later be shown to be unaltered. Around it belong full page screenshots showing the caption, the engagement numbers, the publishing account and the address bar. Every capture needs a timestamp with the time zone written out, because a desk in another country will otherwise read the moment wrongly.

A screen recording of the material playing preserves picture and sound as an ordinary viewer received them. An archive copy made through a public archiving service brings a third party into the record, and that address is often the only one still resolving months later. The publishing account deserves the same attention as the post, including its identifier, its creation date and the rest of its output.

05What the file itself gives away

Synthesis leaves traces at the seams. Mouth shapes drift out of step with consonants when playback is slowed, particularly on sounds that need the lips to close. Edges soften where the generated face meets hair, jaw and the frame of a pair of glasses, and that softening appears during head turns while a resting head looks clean. Teeth are rendered as one block by many models, and reflections in glasses fail to match the room around the speaker.

Audio carries its own seams. Breathing disappears or repeats on a loop, room tone stays constant through a supposedly handheld recording, and sentence endings fall away with a uniformity live speech never has. Sibilants smear, and background noise holds steady whether the speaker faces the microphone or turns away. A waveform view shows these regularities to an untrained eye within a minute.

File properties matter as much as content. Provenance metadata is usually stripped or overwritten, stated creation times contradict the caption, and the encoding profile matches a generation tool where a phone recording would look different. Automated detectors can be run and their output kept, on the understanding that they return probabilities and can be wrong in both directions. A conclusion resting on several independent signals survives scrutiny, while a single detector score collapses under the first question.

06What the distribution reveals

The container around the file often decides a case faster than the pixels do. An account created days before publication, with no history, a stock portrait and a following that arrived in one block, tells a story that needs no forensic analysis. Identical captions surfacing in several languages within an hour indicate a distribution operation working from a template. None of that requires the video itself to be examined.

The request at the end of the funnel identifies the scheme. A forged clip that moves the viewer into a private messenger, a channel of investment signals or a payment address is an investment scheme wearing a familiar face. Reported payment patterns support that reading, since 66 per cent of authorised push payment cases in the United Kingdom begin online and a further 17 per cent begin over telephone networks.

Following the funnel produces the material that makes a report land. The destination channel, the account behind it, the wallet or bank details displayed and the script used in messages turn a content complaint into a fraud case, and fraud cases move faster. That chain has to be captured without entering into any transaction. Where money has already moved, the payment provider holds the strongest ability to act quickly.

07Namesakes, spellings and honest confusion

A name in one alphabet becomes several names in another. The same person appears as Ilia, Ilya or Ilja, the patronymic as Nikolaevich or Nikolayevich, and the surname as Zavialov or Zavyalov, depending on the transliteration standard applied. Each variant is a separate search result, a separate profile and a separate opening for a forger. A dossier listing the accepted forms turns a scattered footprint into one identity that can be checked in a single pass.

Genuine namesakes complicate the picture. Two people sharing a first name, a patronymic and a surname is unremarkable, and material about one surfaces in searches for the other with no ill intent involved. Confusion of that kind is corrected by publishing distinguishing detail such as the field of work, the city and the real publishing channels. Treating an honest mix-up as an attack spends credibility that a real complaint will need.

Deliberate impersonation carries markers that ordinary confusion lacks. The forged material reproduces the biography, borrows portraits from real events, imitates the manner of speech and finishes with a request for money or credentials. Where those elements appear together, the question of coincidence is closed. That distinction belongs in the report, because the desk receiving it has to choose between a naming dispute and a fraud case.

08Where the report goes and in what order

Order is chosen by speed and by leverage. The platform hosting the material acts fastest, and its impersonation channel usually works better than its copyright channel, because the claim concerns identity and consent. Where the material sits on a standalone site, the hosting provider and then the domain registrar are the next steps, each with a published abuse address.

Money creates a second track running in parallel. If any payment has been made or attempted, the receiving bank or payment provider should be notified with the transaction details, since they can freeze and trace. National cybercrime reporting bodies collect the case even when the individual sum is small, and the reference number they issue proves useful in every later exchange. A case with a police reference is read differently by platforms and providers.

The remaining routes depend on what the forgery claims. Advertising regulators become relevant where the clip ran as paid promotion, financial regulators where it promises returns, and professional bodies where the fake claims a licence. Search engines maintain their own procedures for removing results that contain synthetic material about an identifiable person, which repairs the search results even while the source page survives. Filing through several channels in parallel is standard practice and weakens none of them.

09What makes a report actionable

A report is read by a person with a queue. The material has to answer, inside the first paragraph, who is being impersonated, what the recording claims, why the claim is false and what action is requested. Everything else belongs in an ordered annex with one artefact per entry. Reports that open with legal argument and reach the facts on the third page sit in the queue longest.

The annex should carry exact addresses, capture times with the time zone, file hashes and account identifiers, each on its own line for copying. A plain statement that the person neither took part in the recording nor consented to the use of their likeness belongs in the body, since consent is the fact the reviewer establishes. A verifiable pointer to the authoritative public record lets that reviewer confirm identity without contacting anyone.

Restraint carries weight in this format. Claims that cannot be supported, threats of litigation and damage estimates nobody can verify give a reviewer reasons to defer the case. A calm description of a forgery, with artefacts attached and a single clear request, is handled as routine work. The tone that produces action is the tone of a case file.

10After the removal, the copy that comes back

Removal is a state, and it holds until somebody re-uploads. Copies are taken before deletion, clipped into shorter versions, re-encoded, mirrored on services with looser rules and reposted under fresh captions. A closed case therefore continues as a monitoring routine built on searches across the forms of the name, reverse image checks on the frames used and alerts on phrases from the script. The first re-upload tends to appear within days, while the audience is still small.

A log keeps the effort compounding. Each entry records the address, the capture time, the channel used, the reference number issued, the response received and the date the material disappeared, all in local time so the sequence reads correctly later. That log becomes the basis of every escalation, because a provider that ignored three earlier notices about the same account stands in a different position.

The last element of the response is the published record of the person. Search results are answered with material, and a clear dossier under the name, updated and dated, occupies the positions a forgery would otherwise reach. Anyone who meets the fake and then searches the name should arrive at the authoritative account first. That outcome outlasts any single removal.

11Questions and answers

How can I tell whether a video of a person is a deepfake?

Slow the playback and watch the lips on closing consonants, the edges of the jaw and hair during head turns, and the reflections in glasses. Then listen for missing breathing and a room tone that never changes. A detector score is one input among several and should never carry a conclusion on its own.

How much audio does someone need to clone a voice?

A convincing clone can be produced from about three seconds of recording and reaches around 85 per cent accuracy. In a controlled test, listeners told a genuine voice from a cloned one in 37.5 per cent of attempts, so recognising the voice proves nothing about who is calling.

What should I save before reporting a deepfake?

Download the original file, calculate a hash of it immediately, and take full page screenshots showing the caption, the account and the address bar. Record every capture time with the time zone written out, and make an independent archive copy, because the post can be deleted or edited within hours.

Where do I report a video that uses my face without permission?

Start with the platform impersonation channel, then the hosting provider and the domain registrar if the material sits on a standalone site. Notify the bank or payment provider where any money moved, and file with the national cybercrime body to obtain a reference number for later escalations.

Is it worth reporting when no money was lost?

In four impersonation reports out of five there was no monetary loss at all, and those reports are still what builds the record against an account or a network. A filed case with a reference number also gives platforms and providers a reason to act faster on the next notice.

How do I tell a namesake from someone impersonating me?

A namesake shares the spelling of the name and nothing else, and the confusion clears once the field of work, the city and the real publishing channels are visible. Impersonation copies the biography, borrows portraits from real events, imitates the voice and ends with a request for money or credentials.

Reference updated: 4 September 2026