A phone call from a family member's voice, asking for money urgently. A video message from a company's CEO, approving a payment on the spot. Both can now be faked convincingly, using nothing more than a short public sample of someone's voice or face. Understanding how this works — and what still holds up as a defense — matters more than being able to spot a fake by eye.
How little it actually takes
Voice cloning tools today can produce a convincing imitation from just a few seconds of clean audio — a voicemail greeting, a video posted online, a clip from a call. Video deepfakes need more material, but public figures and anyone active on video calls or social media already provide enough.
This is worth sitting with: the barrier here isn't a Hollywood-grade production. It's closer to "did this person ever post a video or leave a voicemail" — which describes most people.
The tells that still work — for now
- Audio artifacts. Cloned voices can sound slightly flat, have unnatural pacing, or handle emotional inflection oddly — genuine surprise or laughter is still hard to fake convincingly.
- Visual inconsistencies in video. Unnatural blinking, lighting that doesn't quite match the face, or lip movement that's a fraction of a second off from the audio.
- No real interaction. Most deepfake scams are pre-recorded or one-directional. Asking a live, specific, unpredictable question — not something rehearsed — is often enough to break the illusion, because real-time interactive deepfakes are still far harder to pull off convincingly.
None of these tells are permanent. Detection technology and generation technology are in a constant back-and-forth, and visual/audio spotting will keep getting harder. Which is why the more durable defense isn't about training your eye — it's about changing your process.
What actually holds up
- A callback, not a call-back. If a voice or video asks for money or sensitive action, hang up and call the person back on a number you already had — not one provided in the message.
- A shared code phrase. Families and small teams handling sensitive requests can agree on a simple verification phrase in advance. It sounds excessive until it's the thing that stops a real attempt.
- Slow down for anything financial. Urgency plus a request for money or credentials is the actual pattern to distrust — regardless of how convincing the voice or face sounds.
Deepfakes are a genuinely new kind of threat, but the underlying discipline that defeats them isn't new at all: never let the request itself be the only proof you have that it's legitimate.