What Is a Deepfake

A deepfake is media in which a person's face or voice has been synthesized or swapped using deep learning, along with the technique that produces it. As generative methods such as GANs (generative adversarial networks) and diffusion models have spread, producing high-quality forged media no longer requires specialist knowledge.

The technology grew out of film visual effects and academic research, but it has been abused to make social engineering and phishing far more convincing. Reported tactics include vishing (voice phishing) calls that imitate an executive's voice to order a payment, and videos that impersonate a real person in order to win trust.

The reason the tactic works is that a voice or a face is intuitively accepted as proof of identity. The habit of not questioning what matches is itself the entry point, so defenses belong in verification procedures rather than in the ability to tell a fake apart.

Abuse Tactics and Damage Patterns

Attacks that use deepfakes raise the persuasive power of traditional social engineering. The main patterns of abuse are as follows.

Business email compromise, upgraded: an executive's voice is synthesized to order an urgent transfer over the phone. In a case reported in 2019, a UK subsidiary wired roughly USD 240,000 (EUR 220,000) after a call that imitated the voice of the CEO at its German parent company
Impersonation in video meetings: reports in May 2024 described an employee at the Hong Kong office of the engineering firm Arup being drawn into a video meeting in which synthesized video and audio posed as several senior colleagues, leading to a series of transfers and losses of about USD 25 million
Breaking through identity verification: attempts to defeat a financial institution's video-call identity check (eKYC) with real-time face synthesis
Use in digital identity theft: harvesting facial data from photos and videos posted on social media to create impersonation accounts
Disinformation campaigns: spreading fake video of politicians or public figures to steer opinion or unsettle markets

Audio deepfakes can be generated from a sample only seconds long, cost less than video, and leave fewer traces, so phone-based fraud deserves particular caution. Caller ID can be spoofed, so a legitimate number on the screen and a matching voice are not grounds for confirming who is calling.

Detection Technologies and How to Spot Deepfakes

Detecting deepfakes is a race against the generation side, and no method settles authenticity. In practice it helps to treat detection as measuring how much doubt is warranted.

Technical Detection Methods

Biological signal analysis: using the faint pulse variation (rPPG) and blink patterns present in genuine footage as clues. In synthetic video these signals are sometimes missing or unnatural
Frequency-domain analysis: images produced by GANs are known to leave characteristic artifacts in the spatial frequency spectrum, and a Fourier transform can sometimes surface traces invisible to the eye. The same signature does not appear once the generation method changes, so it works poorly against output from other approaches such as diffusion models
Watermarking and provenance tracking: work is progressing on embedding a record of how content was created and edited as metadata, based on the specifications of C2PA (Coalition for Content Provenance and Authenticity). It cannot judge material that carries no provenance, so it remains a way to confirm that provenance exists

Clues a Person Can Notice, and Their Limits

Blurring or unnatural distortion where the face meets the background
Blinking that is unusually infrequent (a common flaw in early synthetic footage)
Lip movement that drifts out of sync with the audio
Lighting direction that does not match the shadows
Unnatural rendering of fine detail such as ears and teeth

These clues work on low-quality output but fade as generation quality rises. Detection tools that return a confidence score (such as Video Authenticator, released by Microsoft in 2020) do not hand down a yes-or-no verdict either. Finding nothing wrong by eye or by tool is not proof that the material is genuine.

Defense Strategies for Individuals and Organizations

Countering the deepfake threat calls for technical measures and operational measures together. The key is to design processes so that judging authenticity is never left to the eyes of whoever happens to be on the call.

Individual Measures

Limit who can see your photos and videos on social media: the more public face and voice data there is, the more room an attacker has to generate a high-quality deepfake
Verify suspicious contact: if an urgent call or video call arrives from someone claiming to be an executive or a family member, do not decide within that call. Hang up and call back on a number you already know or a contact from the company directory (avoid calling back from the incoming-call log)
Turn on two-factor authentication: it blocks account takeover through impersonation. Some scams talk the victim into reading a code out over the phone, so it works only alongside a rule of never telling anyone a code

Organizational Measures

Require multi-step approval for transfers and confidential data: enforce a rule that no high-value transfer is approved on the strength of a call or a video meeting alone
Train employees: make the existence and the tactics of deepfakes widely known and build the habit of not taking what is seen at face value. Make it clear as well that holding up a payment in order to verify it will not be held against anyone
Adopt content authentication: use C2PA-enabled tools and platforms so that the provenance of media from inside and outside the company can be checked

Attacks that combine personal data exposed in a data breach with a deepfake are more convincing than conventional phishing, which is why layered defenses matter. For a practical walkthrough, see How to Spot Deepfakes: Protecting Yourself from Fake Videos and Audio.

Common Misconceptions

Only experts can create deepfakes: With the proliferation of open-source tools and cloud services, it is now possible to perform face swaps and voice synthesis in minutes without technical expertise. Even smartphone apps can generate basic deepfakes.
You can always spot a deepfake by watching carefully: Improved generation quality means that some deepfakes cannot be told apart by eye. With low-resolution video or short audio clips, even specialists sometimes struggle to judge accurately. Detection tools do not settle the question either, so verifying a payment or an identity through a separate channel is more reliable than trying to spot the fake.

Deepfake