In early 2024, a finance worker at the Hong Kong office of British engineering firm Arup joined a video call with what looked like his company's chief financial officer and several colleagues. Every face on screen was fake — AI-generated recreations of real people. The employee followed their instructions and transferred HK$200 million (about US$25.6 million) across 15 transactions before the fraud was discovered. Hong Kong police later confirmed everyone else on the call had been a deepfake, and Arup said its computer systems had never been breached — the attackers had simply broken into one person's trust.
Deepfakes have also hit ordinary life in other ways. In January 2024, sexually explicit AI-generated images of singer Taylor Swift spread across X (formerly Twitter), with a single post reportedly viewed over 45–47 million times before removal. That same month, thousands of voters in New Hampshire, USA, received robocalls in an AI-cloned voice of then-President Joe Biden urging them not to vote; within weeks, the US Federal Communications Commission ruled that AI-generated voices in robocalls are illegal under existing law.
So why do these fakes look — and sound — so convincing? And more importantly, how can an ordinary person tell the difference? This article explains the tech in plain language.
Why Deepfakes Look So Real
The word "deepfake" comes from deep learning (a branch of artificial intelligence) plus "fake". A deepfake is any photo, video or audio in which AI has replaced, altered or generated a person's likeness. The face you see might be real footage with someone else's face pasted on, or an entirely synthetic image that never existed.
A few important terms to know:
- Face swap — one person's face is replaced with another's in a photo or video, while the original person's body, lighting and background stay the same.
- Lip sync / voice cloning — a person's voice is recreated so they appear to say words they never said, often paired with matched lip movements.
- Fully synthetic media — the entire image or video is generated from scratch by an AI model, with no real person involved at all.
Deepfake technology grew out of the same kind of AI that powers large language models — models trained on huge collections of data until they learn the patterns.
How the Trick Works: The Tech Behind Fake Faces
Autoencoders and face swaps
The classic face-swap deepfake relies on a technique called an autoencoder — a neural network trained to "compress" a face down to its essentials and then rebuild it. The creator trains two such networks: one on the person they want to appear (say, a celebrity or a colleague), and one on the person in the original video. Because both networks share a common core, the system learns what a face "is" in general, and can then take person A's face and rebuild it using person B's features — dropped onto person B's head movements, blinking and lighting.
That shared "face essence" is why the result moves so naturally. The model isn't cutting and pasting pixels; it has learned how faces behave, so the swapped face turns, blinks and casts shadows plausibly.
GANs: a forger and a detective
GANs (generative adversarial networks) were the breakthrough behind most viral face swaps of the late 2010s and early 2020s. A GAN pits two neural networks against each other: a generator that creates fake images, and a discriminator that tries to tell fake from real. Each time the discriminator catches a fake, the generator improves. Repeat that contest millions of times and the generator becomes astonishingly good — good enough to produce faces that fool the human eye.
This same "competition" idea now powers other realistic fakes, from invented portraits of people who never existed to AI-generated stock photography.
Diffusion models: the new wave
The Taylor Swift case showed how the game has shifted. According to detection firm Reality Defender, the viral images were produced with diffusion models — the same class of AI behind modern text-to-image tools. A diffusion model learns to build an image step by step from visual "noise", guided by a text prompt. Anyone with a consumer AI image tool can type a description and get a photorealistic picture in seconds — including of a real person's likeness, by deliberately working around safety filters.
The concern: diffusion-based fakes don't even need the target's own video footage. A few public photos are enough raw material.
Voice cloning
Voice fakes work on a parallel track. Modern voice cloning systems need only a few seconds or minutes of someone's recorded voice to learn its pitch, rhythm and accent. They then read out any text in that voice. The New Hampshire robocall case showed how little audio is required — and how powerfully a familiar voice can manipulate people, since a parent's "voice" asking for help feels instantly trustworthy.
Why Your Eyes Get Fooled
There's a psychological reason deepfakes work so well on us: the human brain is wired for fast facial recognition. Evolution taught us to identify faces in fractions of a second, which means we process them intuitively rather than analytically. When a face looks about 90% right, our brain fills in the rest and marks it "real" — we don't naturally zoom in on earlobes or count blinks.
Scammers exploit this on two more levels:
- Authority and urgency — a fake CEO, or even a "bank officer", giving an urgent order short-circuits our critical thinking. The Arup victim's suspicions vanished once the fake CFO appeared live on the call.
- Emotion — a panicked voice that sounds like a family member triggers a stress response, and stressed brains make poor verifiers.
Knowing these tricks exist is half the defence: pause whenever urgency and authority arrive together.
Face Swaps vs Diffusion vs Voice Cloning
| GAN / autoencoder face-swap | Diffusion-based generation | Voice cloning | |
|---|---|---|---|
| What it does | Puts person A's face on person B's body in existing footage | Creates brand-new images or video from a text prompt | Recreates someone's voice reading any words |
| What it needs | Plenty of photos/video of both people | A text prompt; sometimes reference photos | A short voice sample |
| Where it shows up | Fake video calls, scam videos, "celebrity" clips | Viral fake photos, manipulated news images | Scam calls, fake robocalls, "family emergency" frauds |
| Hardest to spot because | Motion, blinking and lighting stay natural | No source photo to compare against | We trust familiar voices instantly |
How to Spot a Fake: Practical Detection Tips
No single trick catches every deepfake, but these checks work in real life:
- Watch the edges. Look at the outline of the face and where it meets the hair, ears and neck. Fakes often show slight flickering or blurred seams there.
- Check the hands and teeth. AI still struggles with hands — odd finger counts, merged fingers — and teeth often look smudged or too uniform.
- Look for natural movement. Real people blink roughly 15–20 times per minute. Faces that barely blink, or whose expressions don't match the voice's emotion, deserve suspicion.
- Test the lighting. Shadows and reflections on the face should match the room around them. Sunglasses or water reflections that don't line up are a giveaway.
- Listen for oddities. Cloned voices often sound slightly flat, mispronounce names, or pause unnaturally between words. In the New Hampshire case, one voter realised the "Biden" call was fake because what he was saying simply didn't make sense.
- Check the source. Reverse-image search a suspicious photo. Real events get reported by multiple established news outlets; a photo that exists only on social media posts is a red flag.
- Verify through a second channel. The Arup scam would have been stopped by one phone call to the CFO's known number. If a "family member" calls asking for money, hang up and call them back on their real number. For more on building habits like this, see our guide to cybersecurity basics everyone should know.
- Slow down urgent requests. Scammers rely on urgency. Any demand for immediate money or access — especially "don't tell anyone" — is itself a reason to pause and verify.
The Bigger Picture
Deepfake abuse is moving faster than defences, but responses are growing. The FCC's February 2024 ban on AI-voice robocalls followed the New Hampshire incident within weeks. In the US, the TAKE IT DOWN Act, signed in 2025, requires platforms to remove reported non-consensual intimate imagery — including AI versions — within 48 hours, and creates federal criminal exposure for knowingly distributing it. China has required deepfake content to be labelled since January 2023, and multiple countries now mandate disclosure of AI-generated election content.
For ordinary people, the defence isn't fancy detection software — it's habits: verify through a second channel, distrust urgency, and remember that seeing is no longer believing. Good security hygiene helps too — things like using a password manager reduce your exposure to the phishing messages that often accompany these scams.
Takeaway Checklist
- Deepfakes use AI (autoencoders, GANs, diffusion models) trained on huge datasets to swap, alter or fully generate faces, images and voices — real cases include the Arup US$25.6 million video-call scam, the Taylor Swift image abuse, and the fake Biden robocalls.
- Your brain fills in the gaps, which is why ~90%-convincing fakes feel fully real. Authority and urgency are the scammer's favourite levers.
- Spot-check the details: face edges, hands, teeth, blinking, lighting mismatches, flat or odd-sounding audio, and implausible claims.
- Reverse-image search suspicious photos and cross-check news across multiple reputable outlets.
- Always verify through a second channel: call the real number, message the real account — never use contact details the suspicious message gives you.
- Slow down. Urgency + secrecy = red flags. The scam depends on you acting before you think.
- Know it's illegal in many places now: AI-voice robocalls were banned in the US in February 2024, and several countries require deepfake labelling — so report them.
