Deepfake Defense Fundamentals

A deepfake is audio, an image or a video made or changed by AI so that a real person appears to say or do something they never did. A few years ago this needed skill and hours of footage. Today, consumer tools can imitate a voice from a short clip and swap a face in a live video call.

Government agencies have warned about this directly. The FBI's Internet Crime Complaint Center has published public warnings that criminals use AI-generated voice, images and video to make fraud more believable, including impersonating family members and senior officials. The US Federal Trade Commission has warned consumers about voice-cloning scams where a 'family member' calls in distress.

The important point for this course: deepfakes do not create a new kind of scam. They make old scams — the emergency call, the urgent boss request, the investment pitch from a celebrity — more convincing. That means the defences that beat the old scams still work, as long as you use them even when the voice or face seems real.

The most common deepfake scam aimed at ordinary people is a phone call. A voice that sounds like your child, grandchild or partner says they have been in an accident, arrested or kidnapped, and need money now. Often a second person — a 'lawyer', 'police officer' or 'kidnapper' — takes over the call.

The script relies on panic and secrecy: 'Don't tell Mum', 'You have to pay in the next hour', 'Send gift cards / crypto / a courier will collect cash'.

What works: - Hang up and call the person back on the number you already have for them. - Agree a family code word in advance that is never posted online, and ask for it. - Ask a question only the real person could answer — not something on their social media. - Treat any request for gift cards, crypto, wire transfers or cash couriers as a scam signal on its own.

A cloned voice can sound exactly right. That is why you never try to decide by how it sounds.

Businesses face a version aimed at staff who can move money. An email or message 'from the CEO' asks for an urgent, confidential payment, and a short call or video meeting with a convincing face and voice is used to remove doubt. Hong Kong police publicly described a 2024 case in which an employee was persuaded to transfer large sums after a video call where other participants were deepfaked.

The controls that stop this are process, not perception: - Any new payee or changed bank details is confirmed through a second, known channel. - Payments above a set amount need two people. - 'Confidential' and 'urgent' together are a reason to slow down, not speed up. - Staff are told, in writing, that they will never be punished for verifying a request from a senior person.

If your organisation does not have these rules written down, that is the first thing to fix.

Scammers use deepfaked clips of well-known people — business leaders, TV presenters, creators — to advertise investment platforms, giveaways and 'government schemes'. These appear as social media ads, fake news articles and direct messages.

Red flags: - A famous person personally promising returns, or asking you to sign up today. - Links to websites that are not the person's or a regulated firm's official site. - Accounts with slightly misspelled handles, few old posts or recently changed names. - Requests to move the conversation to WhatsApp or Telegram.

Check the account and link before engaging. You can run a social handle or link through a GACS check, and look the firm up on your country's financial regulator register. Real public figures do not send you private investment offers.

Visual tells — odd blinking, blurred edges around hair, mismatched lighting, teeth or earrings that shimmer — can still show up, but newer tools fix many of them. Researchers and agencies consistently advise against relying on spotting artefacts.

Detection tools, including GACS checks, look for statistical signs of generation or editing. They are useful as a second opinion, especially on images and short clips, but: - They can miss high-quality fakes. - They can flag real media that has been heavily compressed or filtered. - A frame-based video check does not analyse voice, lip-sync or motion over time.

So use a tool to decide whether to dig further, never as the final word that something is real. A 'probably real' result does not make an urgent money request safe.

If someone is using your face, voice or name: 1. Save evidence: screenshots, links, account handles, dates and any messages sent to your contacts. Do not delete anything yet. 2. Warn the people most likely to be targeted — family, customers, followers — through your real accounts. 3. Report the content on each platform using its impersonation or synthetic-media reporting option. 4. If money was lost, contact your bank or payment provider immediately, then report to your national fraud reporting service (for example IC3 in the US, the Canadian Anti-Fraud Centre in Canada, or Report Fraud in the UK). 5. Keep a simple log of every report and reference number.

GACS paid plans can monitor for impersonator accounts and help draft takedown notices, but those are drafting aids — platforms make the final decision, and you should review anything before submitting.