How to spot a deepfake? Mostly you won’t, not by looking. What you can do is check the request. Put the phone down, ring the person on the number saved in your contacts, and see if they know what you’re talking about. A perfect fake fails that test just as fast as a bad one.
The usual tips (odd blinking, blurry edges, lips out of sync) were written for clumsy early fakes. The people fooled in this library weren’t careless. In the biggest case, an employee sat through a whole video meeting and nothing looked wrong.
| What people check | How reliable it is | What to check instead |
|---|---|---|
| Blinking, lighting, blurry edges | Weak, and getting weaker every year | Whether you can reach the person another way |
| Does the voice sound right? | Weak. A short public recording can be enough to copy it | A question only the real person could answer |
| Is the caller ID or profile photo right? | Weak. Both are easy to fake | Calling back on a number from your own records |
| Is the channel normal for this person? | Strong | The LastPass employee noticed a CEO on WhatsApp and stopped |
| Is there a payment, secrecy or rush? | Strong | Any one of these means: verify first |
Key takeaways
In early 2024, a finance employee at Arup’s Hong Kong office joined a video conference with what looked like the company’s CFO and several colleagues. Hong Kong police said every one of them, apart from the employee, was a deepfake built from public footage. The employee made 15 transfers, about US$25.6 million in total. See the Arup case.
If the image had been the giveaway, that meeting would have exposed it. It didn’t. So treat the picture and the voice as unknown either way, and make your decision on something else.
In 2024, someone used an AI copy of LastPass’s CEO’s voice over WhatsApp. The employee who got it didn’t analyse the audio. They noticed the CEO doesn’t contact staff on WhatsApp, the message was oddly pushy, and they reported it. LastPass said there was no impact. See the LastPass case.
Almost every deepfake scam here ends with a request: wire funds, set up a deal, keep it quiet. WPP’s attackers staged a Teams call with a cloned voice of a senior executive to push an agency leader into setting up a “new business”. The target got suspicious and nothing was paid. See the WPP case.
Hang up. Ring the person on a number you already have, from the company directory or your phone’s contacts, not from the message. A live fake can’t follow you onto a call you started.
Finance teams that sign off payments by voice should have a code phrase, agreed in person. No phrase? Ask about last Tuesday’s lunch, or whatever else a stranger couldn’t google.
Tip: if someone on a video call won’t let you call them back, that’s your answer. Real colleagues don’t mind.
Handy for a newsroom vetting a viral clip. Less handy at 4:55pm when the “CFO” wants a wire out before close. These tools hand you a percentage, and next year’s fakes will beat this year’s detector. Where money’s involved, lean on the callback.
The cheap ones, maybe. The Arup employee sat through a whole meeting of good ones without a flicker of doubt, so your eyes are a poor gatekeeper for anything involving money.
Rarely the voice. Usually it’s the setup: an unknown number or WhatsApp, a boss who suddenly needs something urgent and hush-hush. That’s reason enough to hang up and ring back.
End the call politely, then contact the person through a channel you already trust. Report it to your security team, even if nothing was lost, as LastPass’s employee did.
Yes. Fake celebrity videos promoting investments are common. In one UK case, a man lost about £76,000 after a deepfaked Facebook ad. See the fake celebrity investment case.
Reviewed by SEE Team. Last reviewed 24 Oct 2026. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples