{"id":25212,"date":"2026-02-06T15:39:42","date_gmt":"2026-02-06T11:39:42","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=25212"},"modified":"2026-02-06T15:39:42","modified_gmt":"2026-02-06T11:39:42","slug":"how-to-recognize-a-deepfake","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/how-to-recognize-a-deepfake\/25212\/","title":{"rendered":"How to recognize a deepfake: attack of the clones"},"content":{"rendered":"

Technologies for creating fake video and voice messages are accessible to anyone these days, and scammers are busy mastering the art of deepfakes. No one is immune to the threat \u2014 modern neural networks can clone a person\u2019s voice from just three to five seconds of audio<\/a>, and create highly convincing videos from a couple of photos. We\u2019ve previously discussed how to distinguish a real photo or video from a fake and trace its origin to when it was taken or generated<\/a>. Now let\u2019s take a look at how attackers create and use deepfakes in real time, how to spot a fake without forensic tools, and how to protect yourself and loved ones from \u201cclone attacks\u201d.<\/p>\n

How deepfakes are made<\/h2>\n

Scammers gather source material for deepfakes from open sources: webinars, public videos on social networks and channels, and online speeches. Sometimes they simply call identity theft targets and keep them on the line for as long as possible to collect data for maximum-quality voice cloning. And hacking the messaging account<\/a> of someone who loves voice and video messages is the ultimate jackpot for scammers. With access to video recordings and voice messages, they can generate realistic fakes that 95% of folks are unable to tell apart<\/a> from real messages from friends or colleagues.<\/p>\n

The tools for creating deepfakes vary widely, from simple Telegram bots to professional generators like HeyGen and ElevenLabs. Scammers use deepfakes together with social engineering: for example, they might first simulate a messenger app call that appears to drop out constantly, then send a pre-generated video message of fairly low quality, blaming it on the supposedly poor connection.<\/p>\n

In most cases, the message is about some kind of emergency in which the deepfake victim requires immediate help. Naturally the \u201cfriend in need\u201d is desperate for money, but, as luck would have it, they\u2019ve no access to an ATM, or have lost their wallet, and the bad connection rules out an online transfer. The solution is, of course, to send the money not directly to the \u201cfriend\u201d, but to a fake account, phone number, or cryptowallet.<\/p>\n

Such scams often involve pre-generated videos, but of late real-time deepfake streaming services have come into play. Among other things, these allow users to substitute their own face in a chat-roulette or video call.<\/p>\n

How to recognize a deepfake<\/h2>\n

If you see a familiar face on the screen together with a recognizable voice but are asked unusual questions, chances are it\u2019s a deepfake scam. Fortunately, there are certain visual, auditory, and behavioral signs that can help even non-techies to spot a fake.<\/p>\n

Visual signs of a deepfake<\/h3>\n

Lighting and shadow issues.<\/strong> Deepfakes often ignore the physics of light: the direction of shadows on the face and in the background may not match, and glares on the skin may look unnatural or not be there at all. Or the person in the video may be half-turned toward the window, but their face is lit by studio lighting. This example will be familiar to participants in video conferences, where substituted background images can appear extremely unnatural.<\/p>\n

Blurred or floating facial features.<\/strong> Pay attention to the hairline: deepfakes often show blurring, flickering, or unnatural color transitions along this area. These artifacts are caused by flaws in the algorithm for superimposing the cloned face onto the original.<\/p>\n

Unnaturally blinking or \u201cdead\u201d eyes.<\/strong> A person blinks on average 10 to 20 times per minute. Some deepfakes blink too rarely, others too often. Eyelid movements can be too abrupt, and sometimes blinking is out of sync, with one eye not matching the other. \u201cGlassy\u201d or \u201cdead-eye\u201d stares are also characteristic of deepfakes. And sometimes a pupil (usually just the one) may twitch randomly due to a neural network hallucination.<\/p>\n

When analyzing a static image such as a photograph, it\u2019s also a good idea to zoom in on the eyes and compare the reflections on the irises \u2014 in real photos they\u2019ll be identical; in deepfakes \u2014 often not.<\/p>\n

\"How<\/a>

Look at the reflections and glares in the eyes in the real photo (left) and the generated image (right) \u2014 although similar, specular highlights in the eyes in the deepfake are different. Source<\/a><\/p><\/div>\n

Lip-syncing issues.<\/strong> Even top-quality deepfakes trip up when it comes to synchronizing speech with lip movements. A delay of just a hundred milliseconds is noticeable to the naked eye. It\u2019s often possible to observe an irregular lip shape when pronouncing the sounds m<\/em>, f<\/em>, or t<\/em>. All of these are telltale signs of an AI-modeled face.<\/p>\n

Static or blurred background.<\/strong> In generated videos, the background often looks unrealistic: it might be too blurry; its elements may not interact with the on-screen face; or sometimes the image behind the person remains motionless even when the camera moves.<\/p>\n

Odd facial expressions.<\/strong> Deepfakes do a poor job of imitating emotion: facial expressions may not change in line with the conversation; smiles look frozen, and the fine wrinkles and folds that appear in real faces when expressing emotion are absent \u2014 the fake looks botoxed.<\/p>\n

Auditory signs of a deepfake<\/h3>\n

Early AI generators modeled speech from small, monotonous phonemes, and when the intonation changed, there was an audible shift in pitch, making it easy to recognize a synthesized voice. Although today\u2019s technology has advanced far beyond this, there are other signs that still give away generated voices.<\/p>\n

Wooden or electronic tone.<\/strong> If the voice sounds unusually flat, without natural intonation variations, or there\u2019s a vaguely electronic quality to it, there\u2019s a high probability you\u2019re talking to a deepfake. Real speech contains many variations in tone and natural imperfections.<\/p>\n

No breathing sounds.<\/strong> Humans take micropauses and breathe in between phrases \u2014 especially in long sentences, not to mention small coughs and sniffs. Synthetic voices often lack these nuances, or place them unnaturally.<\/p>\n

Robotic speech or sudden breaks.<\/strong> The voice may abruptly cut off, words may sound \u201cglued\u201d together, and the stress and intonation may not be what you\u2019re used to hearing from your friend or colleague.<\/p>\n

Lack of\u2026<\/strong> shibboleths<\/strong><\/a> in speech. <\/strong>Pay attention to speech patterns (such as accent or phrases) that are typical of the person in real life but are poorly imitated (if at all) by the deepfake.<\/p>\n

To mask visual and auditory artifacts, scammers often simulate poor connectivity by sending a noisy video or audio message. A low-quality video stream or media file is the first red flag indicating that checks are needed of the person at the other end.<\/p>\n

Behavioral signs of a deepfake<\/h3>\n

Analyzing the movements and behavioral nuances of the caller is perhaps still the most reliable way to spot a deepfake in real time.<\/p>\n

Can\u2019t turn their head. <\/strong>During the video call, ask the person to turn their head so they\u2019re looking completely to the side. Most deepfakes are created using portrait photos and videos, so a sideways turn will cause the image to float, distort, or even break up. AI startup Metaphysic.ai<\/a> \u2014 creators of viral Tom Cruise deepfakes \u2014 confirm that head rotation is the most reliable deepfake test at present.<\/p>\n

Unnatural gestures.<\/strong> Ask the on-screen person to perform a spontaneous action: wave their hand in front of their face; scratch their nose; take a sip from a cup; cover their eyes with their hands; or point to something in the room. Deepfakes have trouble handling impromptu gestures \u2014 hands may pass ghostlike through objects or the face, or fingers may appear distorted, or move unnaturally.<\/p>\n

\"How<\/a>

Ask a deepfake to wave a hand in front of its face, and the hand may appear to dissolve. Source<\/a><\/p><\/div>\n

Screen sharing. <\/strong>If the conversation is work-related, ask your chat partner to share their screen and show an on-topic file or document. Without access to your real-life colleague\u2019s device, this will be virtually impossible to fake.<\/p>\n

Can\u2019t answer tricky questions.<\/strong> Ask something that only the genuine article could know, for example: \u201cWhat meeting do we have at work tomorrow?\u201d, \u201cWhere did I get this scar?\u201d, \u201cWhere did we go on vacation two years ago?\u201d A scammer won\u2019t be able to answer questions if the answers aren\u2019t present in the hacked chats or publicly available sources.<\/p>\n

Don\u2019t know the codeword. <\/strong>Agree with friends and family on a secret word or phrase for emergency use to confirm identity. If a panicked relative asks you to urgently transfer money, ask them for the family codeword. A flesh-and-blood relation will reel it off; a deepfake-armed fraudster won\u2019t.<\/p>\n

What to do if you encounter a deepfake<\/h2>\n

If you\u2019ve even the slightest suspicion that what you\u2019re talking to isn\u2019t a real human but a deepfake, follow our tips below.<\/p>\n