Are you sure it’s a deepfake? A common version of this scam involves extorting the hacked user to record a video in exchange for getting their account back.
I've been on voice chat with her throughout the day trying to help her fix the problem. So I've seen it happen in real time, from the suspicious login in Nigeria to the deep-fake video that happened later.
If this really happened, there must be some easy to use public tool they used. I'd really love to see the video.
¹ There's no way anyone else would log into a stolen account from a Nigerian IP.