How to Spot Deepfakes: A Beginner's Field Guide

In February 2024, a finance employee at the engineering giant Arup joined a video call with his company's chief financial officer and a handful of colleagues. Everyone looked normal. Everyone sounded normal. He approved 15 transfers totalling about US$25 million. Every other person on that call was fake — a deepfake, generated from public video and audio of real executives. He was, reportedly, the only human in the room.

That story is why I stopped treating deepfakes as a novelty. They're now cheap enough that a scammer with a laptop and an afternoon can build your boss's face. So let's talk about what deepfakes actually are, how to spot deepfakes before they cost you money, and which "detection tricks" are already obsolete.

What a deepfake actually is (in plain English)

A deepfake is a photo, video, or audio clip that's been generated or altered by AI to show someone doing or saying something they never did.

The word showed up around 2017, when a Reddit user started swapping celebrity faces into adult videos using an open-source tool built on a machine-learning technique called a generative adversarial network. One model makes fake images, another model tries to catch them, and they fight each other until the output looks real. That's the "deep" part — deep learning — plus "fake."

Three things have changed since 2017:

• It got cheap. A convincing face swap used to need a GPU rig and hours of training. Now there are phone apps.
• It got fast. Generative video models like OpenAI's Sora, Google's Veo, and Runway's Gen-3 can produce a few seconds of synthetic footage in minutes from a one-line prompt.
• It went multi-modal. Voice cloning is arguably the bigger threat. A 3-second audio sample is enough for some commercial tools to reproduce a voice.

And it's no longer fringe. In January 2024, AI-generated explicit images of Taylor Swift spread across X fast enough that the platform temporarily blocked searches for her name. In New Hampshire, a robocall with an AI-generated Joe Biden voice told voters to skip the primary — a $6 million FCC fine followed. This stuff is mainstream now.

How to spot deepfakes: the checks that actually work

Here's my honest take: the old checklist is dying. Early deepfakes didn't blink, had weird ears, and melted in profile. Modern models handle all three. If your whole strategy is "look at the hands," you're going to get fooled by anything made in the last year.

What still holds up tends to be contextual rather than visual. Start there.

Check the source before you check the pixels

The single best question isn't "does this look fake?" It's "who published this, and why now?"

Imitations travel through emotionally loaded moments — a collapsing bank, a scandal, an election, a family emergency. If a clip is engineered to make you feel panic or urgency, slow down. A quick search for the same footage from a second, unrelated outlet kills most fake videos in under a minute. If only one account has it and it's three hours old, be suspicious.

Look for what I call "lighting disagreements"

Deepfakes blend a generated face into existing footage. The face and the room often disagree about where the light is coming from. Watch for shadows falling in two directions, a jawline that doesn't pick up the same colour cast as the neck, or glasses that don't distort the background the way real lenses do.

Also look at edges — hairlines, ears, and shirt collars. That's where blending is hardest, and where a tell still occasionally shows up.

Listen harder than you look

Cloned audio tends to be a bit too even. Real people breathe mid-sentence, swallow, smack their lips, and say "uh." Synthetic voices often have flat emotional range over a long clip — fine for ten seconds, noticeably wrong for two minutes.

Try this: listen with your eyes closed. You'll catch more than you will watching.

Treat a video call as evidence of nothing

That Arup case is the lesson. Seeing a face on a video call no longer proves anything, because live face-swapping software exists and runs in real time.

So verify out-of-band. Hang up, call the person back on a number you already have, and ask something only they'd know. Companies should be doing this for every payment over a set threshold, full stop. I'd make it policy before I'd buy a single detection tool.

Table: the red flags worth your attention

What you notice	Why it might matter
Urgency, secrecy, or a payment deadline	Social engineering, not a technical flaw — but the strongest signal
Shadows or colour don't match between face and room	Face was composited or generated
Edges of hair, ears, or collar look soft or blurry	Blending artifacts
Audio is flat, no breathing, no filler words	Likely voice synthesis
Only one account has the clip, posted minutes ago	No independent corroboration
A video call you didn't schedule, with people who won't go off-camera	Live face-swap setup

Voice cloning: the scam that doesn't need video

If I had to pick one thing for you to worry about, it's this one. Grandparent scams, fake kidnapping calls, "mom, I lost my phone, this is my new number" texts — voice cloning has made all of them dramatically more convincing.

The pattern is always the same: a short, panicked call, a demand for money, and instructions not to tell anyone. The defence is embarrassingly low-tech. Agree on a family code word now, before you need it. Ask a question the real person could answer and a clone couldn't — a childhood pet's name, a made-up detail. And never send money based on a voice alone, no matter how familiar.

Deepfake detector tools: what they can and can't do

There are real tools, and they help. Free options like Hive Moderation's AI-content detector and the InVID-WeVerify browser extension are worth having in your bookmarks. Reality Defender and similar services sell to newsrooms and banks. Google's SynthID embeds an invisible watermark in images made with its models, and the C2PA "Content Credentials" standard — backed by Adobe, Microsoft, and others — attaches a signed provenance record to files.

But know the limits. Detectors are a cat-and-mouse game: they're trained on yesterday's generators and struggle with today's. A "98% accurate" claim usually means 98% on a specific test set. And nearly every detector will fail on a compressed clip someone re-uploaded to social media five times.

Provenance is the more promising direction. If a file carries a verified Content Credential, that tells you something real. If it doesn't, that tells you almost nothing — plenty of legitimate photos are stripped of metadata by the platforms that host them.

The habit that beats every detector

Get comfortable with one sentence: "I'll check and call you back."

That's it. It works on a cloned voice, a deepfaked video call, a suspicious invoice, and a viral clip. Scammers need you to act inside the panic window, and that one sentence closes it.

Key Takeaways

• A deepfake is AI-generated video, photo, or audio of a real person saying or doing something they didn't — and it now takes minutes and costs almost nothing to make.
• Forget the old visual tells. Blinking, hands, and ears are largely fixed in modern models.
• The strongest defence is contextual: pause on anything urgent, then confirm the claim through a second, independent source.
• Treat a video call as zero proof of identity. Call back on a known number and ask a question only the real person could answer.
• Set up a family code word today. Voice cloning scams target panic, and a code word breaks the script.
• Detector tools are useful but imperfect — provenance standards like C2PA are the thing I'd actually bet on long term.

Frequently Asked Questions

How can you tell if a video is AI generated? You usually can't from a single viewing, which is why I'd stop trying. Look instead for a second source reporting the same event, check whether the clip has a Content Credential, and be suspicious when the account posting it is brand new and the content is highly charged. If it matters, verify it with the person or organisation involved directly.

Are deepfake detectors accurate? They catch a lot of older or unedited fakes, but accuracy drops sharply on compressed, re-uploaded, or brand-new content. Use them as one input, not a verdict — a positive result is a reason to look closer, and a negative result doesn't mean the clip is real.

Can deepfakes be used to scam people over the phone? Yes, and this is the most common real-world harm right now. A short recorded clip of someone's voice from social media is enough to build a passable clone. The fix isn't technical — agree on a code word with family, and verify any money request on a number you already had.