Deepfake Test

How to Spot a Deepfake and Why Is It Important?

Most of us have been taught to look for common signs of a deepfake, like unnatural facial movements, mismatched lip movements, robotic voices or anything unusual. These clues can sometimes help. But the technology and the problem are changing at a massive speed.

Consider this 2024 Arup deepfake scam. Hong Kong police reported a case involving an employee who joined a video conference with what appeared to be the company's CFO and other colleagues. In reality, the participants were AI-generated. The employee reportedly transferred around HK$200 million after the meeting. The incident highlighted a central problem: the people on the call looked convincing enough to pass as real.

Hence, this changes what organizations should train their employees in.

The goal should not be to make every employee an expert at spotting deepfakes. Instead, the more useful skill can be to know when not to trust the interaction.

It is important to train employees that a familiar face or voice is not proof of identity. Nor is a realistic-looking video proof that the people on screen are actually real.

How to Spot a Deepfake Call: What to Do in the Moment

If you are on a suspicious call, clues may not be the only defense. Instead, focus on how the request can be verified using a different channel.

Here, these practical steps can help:

• Ask something only the person should know: A question based on a shared or a known context can make it difficult for an impersonator to answer correctly. However, this cannot be the only verification.
• Use a different channel for verification: If you are provided with a number during a suspicious call, avoid using it. Instead, verify using an alternate number through a trusted contact.
• Treat urgency and secrecy as signals: If the attacker pressurizes to act immediately or presses to avoid standard instructions, this could be a red flag.

It is important to know that these controls usually work because they move the interaction away from the channel originally selected by the potential attacker. However, these controls can be bypassed if employees forget or skip procedures under pressure, or feel uncomfortable challenging someone who appears to be their senior.

How to Prevent Deepfake Fraud

Deepfake fraud is difficult to prevent through detection alone, so businesses need controls that remain effective even when an impersonation looks or sounds convincing.

Typically, the following controls can help prevent deepfake fraud:

• Use independent callback verification: For high-risk requests, especially payment or access changes, employees should verify the request through a trusted phone number or communication channel, rather than replying to the original message or call.
• Require dual approval for sensitive actions: High-value payments, changes in access and other high-risk actions should require review and approval from a second authorized person before they are completed.
• Verify sensitive requests across channels: If a request arrives by email, video call or messaging app, confirm it through a separate, established channel.
• Train teams to use AI-assisted security tools: Train employees to recognize AI-enabled impersonation. Using AI-powered deepfake fraud detection, identity verification, or call-analysis tools can act as an additional layer of security.

The importance of the channel was highlighted in a 2024 LastPass incident. A LastPass employee reportedly received a suspicious call from someone impersonating a senior executive. The employee, however, did not provide the requested information because the request came through an uncommon channel. The decision of the employee here did not depend on detecting if the voice was genuine. Instead, the employee recognized that the method of contact did not fit the expected process.

• 442%rise in voice phishing attacks, H1 to H2 2024Source · CrowdStrike
• 700%rise in fintech deepfake incidents, 2022 to 2023Source · Sumsub
• 1 in 4candidate profiles will be fake by 2028Source · Gartner

Where Do the Deepfake Test Scenarios Come From

The deepfake test includes clips covering AI-generated voices, video calls and synthetic faces or identities. Some are real, while others are AI-generated.

The attack patterns behind this test come from a library of 173 real, publicly documented attacks and reported social engineering techniques. Every case has at least two independent sources, with an average of 6.5 sources per case.

These real-world cases help illustrate how AI-generated media can be used to make an identity appear credible.

Explore the Social Engineering Case Library

Test Your Own Audio, Video and Images for Deepfakes

Want to test a suspicious file yourself? Diopter’s Deepfake Detector lets you analyze different types of media for signs of AI generation or manipulation.

The public detector is available for a free first detection, with no sign-up required. The result provides a verdict and detection information to help you decide whether a file needs further review.

Who Is Most at Risk From Deepfake Fraud?

If you approve payments, hire people or run a help desk, the risk is not simply that you might encounter a deepfake. It is that you might trust it at the exact moment a decision needs to be made.

Diopter adds another layer to these situations by analyzing media and live interactions for signals associated with deepfake detection, identity verification and policy alignment. The aim is not to replace verification procedures, but to give teams additional information when an interaction could lead to a high-impact action.