CyphrQ
Menu

Deepfake Scams: How to Spot Them When Your Eyes and Ears Can't

How deepfake voice and video scams work today, why the old visual tells no longer hold, and the verification habits that protect families and businesses.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Updated 12 min read

You can no longer spot a deepfake scam reliably by watching for odd blinking or strange hands. What works is a verification habit: hang up and call back on a number you already know, agree a family code word, and never move money or share credentials on the strength of a single call or video, however urgent it sounds.

A deepfake is audio or video of a real person, generated or altered by AI, that shows them saying or doing something they never did. The technology itself is not the threat. The threat is a scammer using it to borrow the trust you place in a voice or a face.

What do deepfake scams look like, and how do you spot one?

Three patterns come up again and again in official warnings and reported cases.

The executive payment request. A finance employee gets a message from the "CFO" about an urgent, confidential transfer, followed by a call or video meeting that looks and sounds right.

In the most widely reported case, a finance worker at the engineering firm Arup joined a video call in early 2024 with people he believed were the company's CFO and colleagues. Hong Kong police said every other participant was a deepfake. He sent HK$200 million (about US$25.6 million) across 15 transactions, according to CNN. Arup confirmed that "fake voices and images were used." He had initially suspected a phishing email. The video call overrode his doubts.

The family emergency call. A parent or grandparent receives a call from a child or grandchild in distress: an accident, an arrest, a hospital. The voice is right. The caller needs money now, usually by wire, gift card or cryptocurrency. The US Federal Trade Commission (FTC) warned about this in March 2023, noting that all a scammer needs is "a short audio clip of your family member's voice," often lifted from content posted online.

The fake authority or fake colleague. The FBI's Internet Crime Complaint Center (IC3) reported in December 2024 that criminals now generate video for live calls while posing as company executives, law enforcement or other authority figures, and use cloned voices to try to get past voice authentication at banks.

The common thread: a trusted voice or face, a reason for urgency, and a request to move money or hand over access.

Pattern Who is targeted What they ask for First check
Executive payment request Finance and payments staff Urgent, confidential transfer or change of bank details Call the executive back on a number from the company directory
Family emergency call Parents and grandparents Money now, by wire, gift card or cryptocurrency Ask for the family code word, then call back on the number you already have
Fake authority or colleague Anyone, including bank customers Credentials, access, or a payment to "resolve" a problem Confirm on a second channel you control before doing anything

Why can't your eyes and ears catch a deepfake any more?

For years the advice was to look for unnatural blinking, mismatched lip movement, warped hands or odd lighting. Some of that still catches crude fakes, and the FBI's 2024 advisory still lists "distorted hands or feet" among things to look for. I would not build your defence on it, for three reasons.

  1. Quality is rising. The UK's National Cyber Security Centre (NCSC) assessed in January 2024 that generative AI will "make it difficult for everyone, regardless of their level of cyber security understanding" to identify phishing, spoofing or social engineering attempts. Europol's Innovation Lab found manual detection "not actionable at scale," even for trained analysts.
  2. Calls hide flaws. Low resolution, compression and a weak connection are normal on video calls. The artefacts you were told to look for are indistinguishable from ordinary call quality.
  3. Urgency switches off scrutiny. The scam is designed so that the moment you might check is the moment you feel you can't.

The honest position: assume you cannot tell. Then make the decision not depend on telling.

How do you verify a call or video is real?

Four habits. All of them are free.

1. Hang up and call back on a known number. Not the number that called you, not a number in the email or chat. Use the one already in your phone or your company directory. The FBI and the FTC both recommend it. It beats a cloned voice, because the scammer does not control the number you dial.

2. Agree a family code word. The FBI's advice is to "create a secret word or phrase with your family to verify their identity." Pick something that never appears online. Agree that anyone asking for money in an emergency will be asked for it, and that a genuine family member will not be offended.

3. Apply a second-channel rule. Any request to move money, change payment details, share a password or approve access gets confirmed through a different channel than the one it arrived on. Video request? Confirm by phone on a known number. Phone request? Confirm in person or through a ticket your team can see. One channel can be faked. Two independent channels at once is a much harder job.

4. Slow the urgency down. Legitimate emergencies survive a ten-minute delay. "Don't tell anyone" and "it has to be now" are the two phrases that should raise your guard most, in a boardroom or a kitchen.

The FTC adds a payment-method test: requests for wire transfers, gift cards or cryptocurrency are a warning sign on their own, because those are the methods that make money hardest to recover.

What should a business put in place?

Families can rely on habits. Businesses need rules that hold when a confident, senior-sounding voice is pushing against them. Here are the ones specific to voice and video.

  • Verify calls and video meetings, not just emails. A request for money or access that arrives by phone or on a video call gets the same second-channel check as a written one, before anyone acts on it.
  • A known-number call-back list. Keep direct numbers for your executives, finance team, key suppliers and bank in one place staff can reach without asking the caller. When "the CFO" rings, that list is where the call-back number comes from.
  • No exceptions for "urgent" or "confidential" calls from executives. The urgency and secrecy are the attack. Make it explicit that staff will not be penalised for verifying, even when the request turns out to be genuine.
  • Protect the people who get impersonated. The joint NSA, FBI and CISA guidance on deepfake threats to organisations (September 2023) singles out impersonation of leaders and financial officers and recommends training and rehearsing a response. Executives and finance staff should know they are targets.
  • A reporting path with no blame. One obvious place to report a suspicious call or video. Near-misses teach you what the next attempt looks like.

These habits work best on top of a written rule for payment changes, a second approver for large payments, and strong sign-in and email controls. I set those out in AI Phishing Protection for Small Business: The 30-Day Plan.

One thing to do this week if you run a small business: ask your bank what verification it applies to outbound payments and payee changes, then check that your call-back list covers everyone who can approve a payment.

What should you do if you have already been hit?

Speed matters most in the first hours.

  1. Your bank first. Ask them to attempt a recall on the transfer and to flag the receiving account. Do this before anything else.
  2. Then the police or national reporting centre. - UAE (channels checked 24 October 2026): in Dubai, report through eCrime.ae or the eCrime section of the Dubai Police app; call 999 in an emergency or 901 for enquiries. The Dubai Police eCrime Hub lists these channels and has a page on what to do if you've been scammed. In Abu Dhabi, Aman is Abu Dhabi Police's confidential information service, on 800 2626, by SMS to 2828, or through the ADPolice app. - UK: Report Fraud (formerly Action Fraud), the national reporting centre for fraud and cyber crime (in Scotland, Police Scotland on 101). - US: the FBI's Internet Crime Complaint Center at ic3.gov, and ReportFraud.ftc.gov.
  3. Preserve the evidence. Messages, call logs, meeting invitations, any recordings, and transaction records. The FBI asks for exactly this when you file.
  4. Change what was exposed. If credentials or access were shared, reset them and tell your IT team or provider.
  5. Expect a second approach. Scammers who succeed once often return, sometimes posing as the bank or police "investigating" the first loss.

Nobody who has been through this should feel foolish. The Arup employee was a finance professional looking at what appeared to be his own CFO. The lesson is to build a habit that does not rely on being smarter than the fake.

Going deeper: for security and IT teams

Threat model. The attacker needs public audio or video of a leader to clone (for voice, the FTC says a short clip will do), a channel outside your managed systems, and a target who can move money or grant access. In MITRE ATT&CK, a cloned-voice call is T1566.004 Spearphishing Voice. Real-time face swap carries the pretext into a live meeting, as the FBI's December 2024 alert describes.

In practice, three data points:

Case or figure What happened What stopped it, or didn't
LastPass, April 2024 An employee received calls, texts and at least one voicemail carrying an audio deepfake of the CEO over WhatsApp (LastPass) The channel was outside normal business communication and the urgency felt forced, so the employee reported it; LastPass said there was no impact
Arup, early 2024 HK$200 million sent in 15 transfers after a multi-person deepfake video call (CNN, above) Nothing in the call itself; the video overrode an earlier suspicion
IBM, 2026 report One in four malicious breaches were AI-enabled, a 56% increase, at $6 million on average against a $4.99 million global average (IBM) The press release gives no separate cost for deepfake-led breaches

Onboarding, liveness and injection. FinCEN's FIN-2024-Alert004 (13 November 2024) reports a rise since 2023 in suspicious activity reports describing suspected deepfakes, often altered or generated ID images used to open accounts that then receive fraud proceeds. FinCEN names MFA, including phishing-resistant MFA, and live audio or video checks as useful controls. Its red flags include a third-party webcam plugin during the live check, which can feed pre-generated video in place of the camera (an injection attack, as opposed to holding a fake up to a real camera); a request to switch channel after repeated "glitches"; refusing MFA; an ID photo matching a gallery of AI-generated faces; and device or location data that contradicts the documents. Financial institutions filing a SAR are asked to use the key term FIN-2024-DEEPFAKEFRAUD. Ask your identity-verification vendor whether it detects virtual cameras and injected streams separately from presentation attacks, and what independent testing it has passed; FinCEN points to DHS's Remote Identity Validation Technology Demonstration.

Content provenance and its limits. C2PA (Content Credentials) attaches a signed manifest recording where an asset came from and how it was edited. The C2PA's security considerations set out the limits: it "does not offer any protection against the complete removal of C2PA manifests"; a stolen signing key lets an attacker produce valid manifests until the key is revoked; and a correctly signed capture can still lead a viewer to a false conclusion. Treat missing credentials as no signal and valid ones as evidence of origin, not truth. The useful job for provenance is signing the executive videos and statements you publish. It offers nothing on a live call.

Process controls and what to log. Detection fails open; process fails closed. Payment changes follow the rule in the phishing plan. For voice and video, add a callback directory owned by IT that requesters cannot edit; spoken challenge phrases for the few executives who can authorise money, changed after any suspected exposure; and a rule that requests arriving on WhatsApp or a personal number are declined and raised again internally. For every high-risk request, log the channel and account it arrived on, the time, the callback number and who dialled it, the approver and the outcome, near-misses included. Those records are what let you share an attempt with peers, as LastPass did.

Ask your team: which executives have hours of public audio online? Can staff reach the callback directory without asking the caller? When did finance last rehearse a fake-CEO call, as the NSA, FBI and CISA sheet recommends?

Key takeaways

  • Deepfake scams borrow a trusted voice or face, add urgency, and ask for money or access.
  • Visual and audio tells still catch crude fakes, but the UK's NCSC and Europol no longer expect ordinary people to spot good ones. Plan on not being able to tell.
  • The defence is verification, not detection: call back on a known number, use a family code word, confirm money and credential requests on a second channel, and let urgency slow you down rather than speed you up.
  • Businesses should give calls and video meetings the same second-channel check as email, keep a known-number call-back list, make no exceptions for urgent calls from executives, and offer a blame-free reporting path.
  • If you are hit, call your bank first, then report to the police or national centre, and keep every piece of evidence.
  • For IT and fraud teams: watch onboarding for injected video, treat Content Credentials as evidence of origin rather than truth, and log every high-risk request with its callback.

Checklist: before you act on any voice or video request

  • Did the request involve money, payment details, passwords or access?
  • Did it arrive with urgency or a request for secrecy?
  • Have I confirmed it through a second channel I control, using contact details I already had?
  • For family: did they know the code word?
  • For work: did I call back on a number from our list, with no exception made for seniority?

If any answer gives you pause, stop. A genuine request will still be genuine in fifteen minutes.

Sources