Imagine watching a video of a world leader declaring war, a CEO announcing a company's collapse, or a celebrity endorsing a product, only to discover none of it ever happened. Now imagine that video stars you. You're doing something you know with absolute certainty you never did, yet there you are, undeniably, on screen. That's the unsettling power of deepfakes.
Deepfakes are no longer a niche experiment or a problem reserved for tech experts. They are now a mainstream form of digital deception, used in scams, harassment, political manipulation, and misinformation — and they are getting harder to spot.
What are deepfakes?
The term “deepfake” itself, a blend of "deep learning" and "fake" was first coined in late 2017 by a Reddit user of the same name who shared pornographic videos that used open source face-swapping technology to create deepfakes.
At their simplest, deepfakes are AI-generated or AI-altered video, audio, or images that make a person appear to say or do something they never actually said or did. What makes them especially dangerous is not just how realistic they can look or sound, but how quickly they can be created and shared.
That means the risk is no longer limited to celebrities or public figures. Anyone can be targeted, from employees and executives to parents, students, and ordinary social media users. In this guide, you’ll learn what deepfakes are, why they work so well, how to spot warning signs, and what to do if you encounter one.
What began as a niche internet curiosity has rapidly matured into a mainstream concern. As the tools to create deepfakes become cheaper, faster, and increasingly accessible to non-experts, the line between what is real and what is fabricated grows thinner by the day. And the consequences stretch from personal reputation to national security.
How they work, in plain terms
- Training. An AI model ingests hours of photos, video or audio of a target person. It learns patterns: how light falls on their cheekbones, how they pause mid-sentence, which words they favour.
- Generation. Given a prompt, "say this script in this voice" or "make this person appear to say X", the model generates new pixels or waveforms that statistically match the patterns it learned.
- Refinement. Real-time tools now add eye movement, breathing, background noise and lip-sync in under a second. The result is not a bad edit. It is a new recording that never happened.
The deepfake types you will actually encounter in 2026
- Real-time, multimodal impersonations
- Live video call fraud: Attackers are using real-time face-swapping and voice cloning in live video conferencing to impersonate CEOs, CFOs, or trusted colleagues.
- AI-powered vishing (voice phishing): Attackers use cloned voices in urgent phone calls to trick employees or family members.
- Live interview impersonation: Attackers use synthetic audio or video to pose as genuine candidates during remote interviews.
- High-stakes financial and corporate fraud
- Synthetic vendor identities: Fabricated identities are used to infiltrate vendor systems, submit fraudulent invoices, and alter payment details.
- Account takeover (ATO): Deepfakes are used to bypass biometric authentication systems (voice ID or face recognition) at banks and secure platforms.
- Political and geopolitical disinformation
- Synthetic crisis footage: Fabricated, high-fidelity video footage of staged violence or political speeches, designed to provoke panic, influence elections, or escalate geopolitical tensions.
- Election interference: Deepfakes released just days before voting—showing candidates withdrawing or saying inflammatory things—are designed to shift public opinion before fact-checkers can respond.
- "Liar’s dividend" exploitation: The widespread prevalence of deepfakes allows malicious actors to claim that legitimate footage of their misconduct is "just a deepfake," making accountability harder.
- Synthetic identity and social engineering
- AI romance fraud: Synthetic, AI-driven personas build long-term trust, often using voice or video to solidify deception before asking for money.
- Non-consensual intimate imagery (NCII): The creation of explicit, AI-generated content has skyrocketed, prompting new, strict criminal laws.
- “Kidnapping” scams: Criminals use cloned voices of family members to fabricate distress scenarios, such as fake kidnappings or car accidents, in order to extort money.
What deepfakes are not
- They are not always video. Most harm now comes from audio.
- They are not always flawless. High-quality fakes still struggle with complex physics, long-form memory, and real-time interaction.
- They are not detectable by eye alone. In 2026, the tells you read about in 2020 — unnatural blinking, bad teeth, flickering edges — have largely been engineered out. Relying on these tells can create false confidence, unless the deepfake was made using an older or lower-quality model.
Are all AI-generated media content deepfakes?
No. AI-generated video and deepfakes are related, but they are not the same thing. All deepfakes are AI-generated videos, but not all AI-generated videos are deepfakes.
- Deepfakes are designed to manipulate, replace, or superimpose a real person's face, voice, or expressions onto another, often without consent.
- AI-generated video is a broader term for any video content created using artificial intelligence, which can include entirely fabricated scenes, fantastical animations, or "AI slop" that does not impersonate a specific real person.
Key differences between AI-generated content and deepfakes at a glance
|
Feature |
Deepfake |
AI-Generated Video (General) |
|
Purpose |
Deception, impersonation, parody, or harassment. |
Creation, entertainment, art, or simulation. |
|
Target |
Replicates a specific, real person's likeness. |
Often creates new, imaginary, or synthetic people/scenes. |
|
Intent |
High likelihood of being malicious or misleading. |
Can be neutral, creative, or artistic. |
Why deepfakes work so well
Human brains are wired to trust faces and voices as proof of presence. Deepfakes exploit that shortcut by mimicking what we expect to see and hear in familiar situations. In the UK context, where bank transfers are instant via Faster Payments and where the Online Safety Act now treats intimate deepfakes as a criminal harm, that trust shortcut has direct financial and legal consequences.
In short: a deepfake is not "a fake video". It is an AI prediction of how someone would look and sound saying something they never said. The danger is not the technology itself, which is neutral, but the ease, speed and scale with which it can now be deployed by anyone with a laptop, minimal skills, necessary software tools and an internet connection.
This is why the rest of this guide focuses less on spotting pixels, and more on verifying context, provenance and process.
What are the issues with deepfakes?
At their core, deepfakes undermine the most fundamental pillar of modern society, trust in what we see and hear. Their dangers span multiple domains.
The core concern with deepfakes is their ability to erode trust in all forms of media, from news and evidence to personal communications. The threats are amplified across several key areas:
- The Erosion of Reality and Public Trust: Deepfakes can make it seem like someone said or did something they never did. This undermines the reliability of video evidence in court proceedings and creates a situation where real evidence can be dismissed as a deepfake: "liar's dividend". They can create information disorder where false narratives spread faster than they can be debunked.
- Targeted Harassment and Gender-Based Violence: A staggering 98% of all deepfake videos online are pornographic as of 2026, and 99% of these, in 2023, targeted women and girls. This creates a form of digital abuse that leads to severe psychological trauma. Victims face humiliation, isolation and long-term trauma. Many victims withdraw from public life or delete their online presence entirely. Some may also avoid school or work.
- Threats to National Security: Deepfakes can be used to create political instability, spread disinformation during elections, and impersonate government officials. They can also be exploited to manipulate biometric verification systems, posing risks for money laundering and other financial crimes.
- Sophisticated Financial Fraud: Deepfakes are a powerful tool for scammers, enabling them to impersonate CEOs, family members, or trusted figures to authorize fraudulent transactions, steal identities, and run elaborate investment scams.
AI is improving by the day to produce even better deepfakes that are harder to detect than before. Deepfakes are a moving target and the system is playing catch up. It is, in effect, an arms race.
Who makes deepfakes?
Deepfake creation is no longer limited to experts. With the right tools and a modest level of skill, many people can now generate a deepfake from simple prompts.
Making a deepfake involves using AI to swap or generate a person's likeness in videos, images, or audio. While historically complex, modern AI software now allows for faster, more accessible creation. Motivations vary widely.
- Cybercriminals: This is the largest group, motivated by financial gain. They use deepfakes for:
- Fraud: Impersonating company executives to steal millions.
- Extortion & Blackmail: Creating fake intimate images to threaten and demand payment from victims.
- Scams: Using deepfakes of celebrities like Elon Musk or politicians to run fake investment and government benefit scams, costing victims billions.
- State-Sponsored Actors: Governments use deepfakes for political purposes, such as spreading disinformation to destabilize other nations, creating propaganda, or influencing elections, undermining trust in democratic institutions, and supporting psychological operations during conflicts.
- Disgruntled Insiders and Competitors: Current or former employees may use deepfakes to seek revenge or damage a company's or colleague’s reputation.
- Individual Malicious Actors: Individuals create deepfakes for personal gain, such as seeking online attention, increasing social media followers, or cyberstalking. A good example is the arrest of a man in India who was circulating AI-generated deepfake videos of India's national leaders in order to mislead the public, undermine trust in constitutional offices, and threaten social harmony. Another example is a man who was jailed for creating and sharing sexually explicit deepfake images using photos of the faces of real women and children.
Harms caused by deepfakes
The harms of deepfakes are real, far-reaching, and damaging — psychologically, financially, and socially.
- Psychological and Emotional Devastation: Victims of deepfake abuse, particularly women, often experience severe mental health issues, including distress, anxiety, and depression. Alarmingly, research indicates that more than half of deepfake victims in the United States have contemplated suicide.
- Irreparable Personal and Professional Harm: Deepfakes can lead to defamation, destroy personal reputations, and cause victims to withdraw from public life, delete social media accounts, or even change their appearance to escape the abuse.
- Massive Financial Losses: The financial toll can be immense. Reports suggest that a deepfake attack now occurs every five minutes globally, contributing to losses exceeding $4.6 billion in crypto in 2024. This includes funds stolen through CEO fraud, identity theft, and fake investment schemes.
- Systemic Erosion of Trust: Deepfakes contribute to a broader societal "truth decay," making it difficult for people to know what is real. This can undermine public confidence in democratic processes, the media, and even the justice system.
Deepfakes inflict harm that is psychological, financial, social, and systemic.
Deepfakes accelerate a broader crisis:
- People stop trusting institutions, media, and even each other.
- Democracies struggle to maintain shared facts.
- Authoritarian regimes exploit confusion to justify censorship.
Are deepfakes ever used for good?
Yes. While the technology is notorious for its potential for harm, the underlying AI is a neutral tool. Researchers, artists, and medical professionals have found powerful and life-changing applications for deepfakes. When used transparently and ethically, deepfake technology can be a significant force for good.
Education & Cultural Preservation
Deepfakes can bring history to life in unprecedented ways. They can create immersive educational experiences by recreating historical figures for interactive lessons. Beyond entertainment, this technology is also used to preserve and share cultural heritage by reconstructing ancient languages and voices, allowing new generations to connect with their past. A prominent example is the "Malaria Must Die" campaign, where David Beckham's deepfake was used to deliver a powerful multilingual message for a global health cause, demonstrating how synthetic media can amplify social advocacy.
Healthcare & Medical Training
In the medical field, deepfake technology is used to generate synthetic but highly realistic medical data, such as X-rays and MRI scans to help train AI systems for diagnosis. This can help train diagnostic models to detect abnormalities such as tumours without exposing patient data. Furthermore, voice cloning technology offers a lifeline to people who have lost their ability to speak (aphonia), allowing them to recreate their original voice for use with assistive devices.
Creative Arts & Accessibility
The creative industry has also found legitimate uses for synthetic media. Some studios use it for tasks like digital rejuvenation of actors or recreating voices for post-production dubbing. Companies are now deploying AI-generated sign language interpreters commercially, with UK-based Signapse already offering BSL and ASL translation at scale.
The Critical Distinction: Consent, Transparency, and Use
The line between harmful deepfakes and beneficial ones comes down to consent, transparency, and purpose. A deepfake created for a historical documentary with clear labeling is vastly different from a non-consensual pornographic video. As the technology continues to evolve, a strong ethical and legal framework that encourages innovation while punishing abuse will be key to maximizing its potential for good.
How to identify deepfakes in 2026?
As deepfakes become more sophisticated, spotting them in 2026 requires a more careful approach. Some deepfakes still leave behind subtle clues or “artifacts”, but context is often more reliable than visual detail alone.
Many of the visual tells that were reliable in 2020 — unnatural blinking, glassy eyes, poor lip-sync — have largely been engineered out by modern AI models. Note that while some of these cues may still apply to lower-quality or older fakes, they should not be your primary method for assessing content made with recent AI tools. Relying on them in 2026 gives false confidence. The signals worth looking for now are contextual rather than pixel-level.
- Examine Facial Details and Skin: Deepfake faces can look "off" or too perfect. Look for skin that appears overly smooth, plastic-like, or lacks natural texture like wrinkles and pores.
- Lip-Sync Issues: Lip movements that don't perfectly match the spoken audio are a major red flag. In longer clips, speech rhythm and breathing may still feel slightly off.
- Inconsistent Lighting: Shadows and lighting on the face may not match the background, or the face might be brighter than the rest of the scene.
- Look at the Head and Body: Deepfakes often focus on the face and ignore the rest of the body.
- Check if the head size or position seems unnatural for the body.
- Look for blurring or flickering edges around the face, especially where it meets the neck or hair.
- Pay attention to the hands. AI still struggles with rendering hands, which may appear warped, have too many fingers, or move awkwardly.
Software that can help identify deepfakes
Manual detection is becoming more difficult, so specialized software is increasingly necessary. Here is a comparison of some available tools.
The tools listed below reflect options available as of early 2026. Capabilities change rapidly — check each provider's current offering before use.
|
Software |
Key Capabilities |
Target Users |
|
Real-time detection; analyzes video, motion, and depth signals; identifies the generative model used; extremely low false acceptance rate. |
Enterprises (banks, governments) for identity verification and fraud prevention. |
|
|
Claims to detect synthetic audio with high accuracy (up to 99%); integrates with Zoom, Webex, and Teams; top performer in independent tests. |
Enterprises using major video conferencing platforms. |
|
|
Allows users to upload video/audio files or YouTube links for analysis; provides a simple "real or fake" assessment; accessible to consumers. |
General consumers for personal use. |
|
|
A free online demo that allows public, frame-by-frame analysis of uploaded videos. |
General public, researchers, and journalists for investigative purposes. |
Manual detection is becoming harder. These tools assist both individuals and organizations. However, note that detection software is necessary but not sufficient to identify deepfakes.
Detection Limits and False Positives
Why limits matter
Detection tools are improving but are not infallible. Overreliance on automated detectors can produce false positives (flagging real media as fake) and false negatives (missing sophisticated fakes). Understanding limits prevents misattribution and legal or reputational harm.
Common sources of error
- Model generalization gaps: Detectors trained on one set of generative models may fail against new or fine-tuned models.
- Compression and editing artifacts: Social media compression, filters, and legitimate editing can trigger detector alarms.
- Adversarial manipulation: Malicious actors can intentionally add noise or perturbations to evade detection.
- Contextual ambiguity: A real video with poor lighting or low resolution may resemble a synthetic one.
Interpreting tool outputs
- Probabilistic scores: Treat detector outputs as indicators, not definitive proof. Combine multiple signals—technical, contextual, and human review.
- Threshold tuning: Organizations should calibrate detection thresholds to their risk tolerance and the cost of false positives vs. false negatives.
Best practices to reduce misclassification
- Use ensembles: Run multiple detectors and compare results; disagreement signals the need for expert review.
- Human-in-the-loop: Require human analysts to review flagged content before decision making on deepfakes.
- Continuous validation: Regularly test detectors against new synthetic samples and real-world content to measure drift.
Communicating uncertainty
- Avoid absolute language: Use clear qualifiers when publishing or reporting outcomes (e.g., "analysis suggests", "inconclusive", "likely synthetic").
- Document methods used: Openly state which tools and versions were used and how conclusions were reached.
How to protect yourself from deepfakes
In 2026, the best rule is this: context matters more than pixels. Urgency, an unusual channel, and requests to bypass normal processes are all warning signs. Developing a critical and cautious mindset is your first line of defence.
- Practice Scepticism: Adopt a “Trust but Verify” Approach. Approach any emotionally charged or suspicious video with a healthy dose of scepticism. If something seems too shocking, too good to be true, or designed to provoke a strong reaction, it's worth verifying.
- Verify Before Acting: Never act on a request for money, sensitive information, or any urgent action based solely on a video or audio call. Always verify through a separate, trusted communication channel. If a "CEO" asks for a transfer on a video call, hang up and call them back on their known number.
- Check Official Sources: For videos of public figures or major news events, check official accounts, trusted news outlets, and reliable fact-checking organizations to see if the event is real. Report suspicious videos to platform moderators so experts can investigate.
- Question Live Video Calls: In a live video call, you can ask the person to perform a simple action in real-time, such as turning their head to the side or placing a hand in front of their face. Deepfake technology often struggles to render such interactive, non-standard movements convincingly.
- Make varied verification checks the norm during sensitive audio and video calls. Deepfake systems are trained on predictable behaviour. The moment you step outside that pattern, the cracks appear.
- In a live video call, ask the person to do something unexpected — turn fully sideways, hold an object up to their face, or respond to a sudden off-script request. A real person will usually handle this naturally. A deepfake may freeze, distort, or feel subtly off.
- Equally powerful is asking something only the real person could know — not a security question an attacker could research, but a genuinely private reference, a shared memory, or a detail from a conversation that no one else was party to. A fraudster can clone a face or voice. They cannot clone private history.
- Vary your verification routines and avoid predictable scripts. Consistency is the attacker's advantage. Unpredictability is yours.
You don’t need to be a technical expert. You need a mindset shift.
Laws, policies and guidance against deepfakes
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute legal advice.
What laws and platform policies exist to combat deepfakes?
The battle against deepfakes is being fought on two main fronts: formal legislation and the enforcement policies of major tech platforms.
Legal, guidance and policy framework
The UK, European Union, United States, and several Asian jurisdictions are now using a mix of online-safety law, AI transparency rules, criminal penalties, and platform obligations to reduce harm from synthetic media.
United Kingdom
The UK's central framework is the Online Safety Act 2023, enforced by Ofcom, which requires online services to tackle illegal content including abuse, impersonation, and non-consensual intimate imagery.
But the UK response goes beyond removal — the NCSC has warned that generative AI makes fraud and executive impersonation more convincing, meaning businesses should treat deepfake risk as a security issue as much as a legal one, with verification callbacks and clear approval chains for any urgent financial requests.
The OSA's Scope: Sharing
The Online Safety Act 2023 never mentions "deepfakes" by name, but captures them through its phrase "appears to show" — meaning a synthetic or face-swapped intimate image is treated identically to a real one. If the person depicted did not consent, an offence is committed. Being AI-generated is no defence. Platforms regulated by Ofcom must assess the risk of illegal content, provide reporting and complaints procedures, and take proportionate steps to remove illegal content when they become aware of it.
The Creation Gap and How It Was Closed
The OSA's original gap was that making a deepfake wasn't itself a crime — only sharing it was. The Data (Use and Access) Act 2025 closed that. Section 138 of the Data (Use and Access) Act 2025 came into force on 6 February 2026. It created offences covering the intentional production of, or request for the production of, a purported intimate image (including deepfakes) of an adult without consent, even if it is never shared.
The result: in the UK, creating a sexually explicit deepfake without consent is a crime — and sharing one is breaking the law twice.
The Online Safety Act 2023 and the Data (Use and Access) Act 2025 are important parts of the legal response to deepfake-related harm, especially in relation to non-consensual intimate imagery. But they do not prevent other laws from applying. Where a deepfake of any form is used for fraud, harassment, intimidation, or other unlawful conduct, several legal regimes may be engaged at the same time. Which laws apply will depend on the facts of the case, so victims should seek legal advice tailored to their circumstances.
European Union
Under the EU AI Act, providers generating or manipulating image, audio, or video must label that content as AI-generated. Combined with the Digital Services Act's pressure on platforms to manage misinformation, the EU's approach prioritises transparency and disclosure over criminal enforcement — treating deepfakes as a trust problem, not just a legal one. In practice, synthetic content will increasingly require clear labelling and machine-readable provenance.
United States
At the federal level, the TAKE IT DOWN Act (2025) criminalises non-consensual intimate deepfakes and requires platforms to remove flagged content within 48 hours of a valid report. Beyond that, the US relies on a patchwork of state laws adding criminal penalties, civil remedies, and disclosure requirements — particularly for election-related or sexually explicit content. Unlike the UK and EU's centralised approach, the legal path in the US depends heavily on where the content was created, hosted, or shared.
Asia and global examples
China has introduced mandatory labeling and watermarking expectations for AI-generated content, with strong emphasis on traceability and public deception prevention.
South Korea has taken one of the toughest stances on sexually explicit deepfakes, including criminal penalties for producing or possessing certain content.
Japan has taken a more governance-led approach, using its newer AI framework to examine risks, guide responsible innovation, and investigate sexual deepfakes.
Singapore has also moved decisively against harmful deepfake publication and reposting, especially where impersonation or public deception is involved.
Taken together, these examples show that Asia is not following one model, but several distinct ones: labeling in China, criminal enforcement in South Korea, policy oversight in Japan, and rapid intervention in Singapore.
The Legal Landscape
Governments worldwide have moved from debating deepfakes to criminalizing their most harmful uses.
Key global trends show that there is a shift from voluntary to mandatory labeling of AI media products. The need to label AI-generated content is transitioning from best practice to mandatory legal compliance, focusing on watermarking and metadata.
Social media platforms and AI service providers are now legally responsible for managing synthetic content, conducting risk assessments, and adhering to strict takedown timelines.
Here is an overview of the current, key legislative actions from major jurisdictions*:
|
Jurisdiction |
Key Legislation / Action |
Effective Date |
Core Provisions & Requirements |
|
United States (Federal) |
May 19, 2025 |
Criminalizes non-consensual sharing of deepfakes and "revenge porn." Platforms must remove flagged content within 48 hours of a valid request. |
|
|
United States (State) |
2025-2026 |
Supplements federal law with state-level criminal and civil penalties. States like California have supplemented federal laws with aggressive state-level legislation, introducing severe civil penalties and statutory damages for malicious deepfakes. |
|
|
United Kingdom |
July 25, 2025 (duties in force). Section 138 of Data Act came into force on 6 February 2026 |
Requires platforms to proactively remove illegal content (including deepfakes). Introduces offences covering the sharing of intimate images that “show, or appear to show” a person, and later offences covering the creation of purported intimate images without consent. |
|
|
European Union |
Transparency obligations from Aug 2, 2026 |
Introduces transparency obligations requiring certain AI-generated or AI-manipulated content, including deepfakes, to be identifiable as such. |
|
|
China |
Jan 1, 2026; Labeling: Sep 1, 2025 |
Bans deepfakes used for national security threats or public deception. Requires mandatory visible and invisible watermarks on all AI-generated content for traceability. |
|
|
South Korea |
Act on Special Cases Relating to Punishments for Sexual Offences |
Sep. 2024 |
Criminalises possessing or watching AI-generated deepfakes of sexual content |
*Laws and regulatory guidance evolve over time, so the position summarised above may also evolve in time.
Platform Policies & Enforcement
Alongside government action, major tech platforms have introduced their own stringent policies to govern AI-generated content. These policies often mirror legal requirements but are enforced through platform-specific tools and sanctions, as outlined in the table below.
|
Platform |
Key Policy / Requirement |
Effective Date |
Core Provisions & User Impact |
|
YouTube |
Enforcement began March 2024 |
Creators must disclose realistic altered or synthetically generated content that could mislead viewers. When disclosed, YouTube adds a label in the video’s expanded description, and for sensitive topics a more prominent in-player label may also appear. Repeated failure to disclose may lead to content removal or suspension from the YouTube Partner Program. |
|
|
Meta (Facebook, Instagram) |
Rolling out since early 2024 |
Meta uses industry-standard signals and its AI-disclosure tools to label content generated or edited using AI. It may display an “AI info” label when it detects AI-generated content or when a user self-discloses it. For photorealistic video or realistic-sounding audio, users are required to disclose the use of AI. |
|
|
TikTok |
Enforcement strengthened from 2023 onward |
Prohibits accounts that use AI-generated avatars or voice models to mislead users. It has a record of removing deepfake videos of public figures that used unauthorized AI likenesses. |
Legal Remedies and Reporting
Deepfake victims and observers have several legal and reporting options. Depending on the jurisdiction, these may include criminal complaints, civil claims such as defamation or privacy violations, and platform takedown procedures. In the UK, the Data (Use and Access) Act 2025 also criminalised the creation of non-consensual intimate deepfakes, closing a gap left by the Online Safety Act.
Immediate steps
Preserve the evidence: save the original files, screenshots, URLs, timestamps, and related messages. Record when and how you found the content.
Document the context: note who shared it, where it appeared, and any connected comments, emails, or direct messages.
Report it to the platform: use the relevant abuse, harassment, impersonation, or copyright channels, especially if the content is sexual, threatening, or deceptive.
Legal pathways
Criminal law may apply where there is harassment, extortion, impersonation, fraud, or non-consensual intimate imagery.
Civil claims may include defamation, privacy violations, emotional distress, or copyright infringement.
In urgent cases, courts may grant restraining orders, takedown relief, or disclosure orders to identify anonymous perpetrators.
What to expect legally
Legal action can be slow, costly, and more difficult when perpetrators are abroad. Strong evidence matters, so preserving metadata and maintaining a clear record of events can improve your chances.
Reporting resources
Use platform reporting tools and follow up with formal takedown requests where needed.
If a crime is involved, provide law enforcement with a clear evidence pack and timeline.
Victims can also seek help from legal aid services, advocacy groups, and specialist support organisations.
Responding to deepfake incidents
Forensic best practices for journalists and lawyers
Suspected deepfakes should be preserved and analysed in a way that protects credibility and legal admissibility.
Preserve the evidence
Save the highest-quality original file available. Record metadata such as timestamps, file details, URLs, post IDs, and uploader information. Create secure hashes where possible and keep a clear access log.
Verify carefully
Check the event, location, and timeline against independent sources. Use more than one detection tool and avoid relying on a single result.
Use expert support when needed
For high-stakes cases, involve accredited digital forensics labs or qualified research teams. Ensure their methods, tools, and reasoning are properly documented.
Report findings cautiously
Use measured language such as “likely synthetic” or “inconclusive,” explain limitations, and keep copies of outputs, logs, and analyst notes.
Basic chain-of-evidence checklist
Keep the original file, metadata, hash records, access log, and copies of all tool outputs and analyst reports.
Victim support and recovery steps
If you are targeted by a deepfake, act quickly to preserve evidence, limit the spread, and get support.
Immediate steps (first 24–72 hours)
Save the content, URLs, screenshots, and related messages. Record when and where it appeared. Report it to the platform, ask others not to share it, and contact law enforcement if there are threats, extortion, or financial loss.
Short-term recovery
Seek legal advice, use platform escalation channels for serious cases, and access counselling or support services if needed.
Long-term recovery
Consider reputation management if the content has caused public harm. Improve account security, tighten privacy settings, and reduce unnecessary public exposure of personal information. Support groups and advocacy organisations can also help.
Victim checklist
Save the evidence, create a timeline, report the content, seek legal and mental-health support, and keep records of every action taken.
Organizational playbook for deepfake incidents
Organizations should be prepared for deepfake incidents that threaten finances, reputation, or safety. A clear response plan helps reduce damage, speed up decisions, and protect legal options.
Set clear ownership
Assign a senior incident lead and involve key teams such as legal, communications, security, HR, and leadership. Keep trusted forensic, legal, and PR partners ready in advance.
Prepare before an incident
Create policies for verification, takedowns, and public statements. Train staff to spot suspicious media and social-engineering attempts. Maintain monitoring tools, escalation paths, contact lists, and message templates.
Respond quickly and carefully
Assess the scope and likely impact, contain the spread, preserve evidence, and use detection tools or forensic experts where needed. Coordinate internal and external communication using careful language, especially before verification is complete.
Protect people and reputation
Prioritize the privacy and safety of anyone targeted. Avoid making firm public claims too early, and use pre-approved statements for likely scenarios such as impersonation, extortion, or fake announcements.
Improve after the incident
Review what happened, update the playbook, retrain staff, adjust detection processes, and follow up on any legal or insurance action.
Quick checklist
Identify an incident owner, maintain external expert support, deploy monitoring tools, document communication templates, and run regular training and exercises.
Ethics, Watermarking, and Provenance
The ethical use of synthetic media depends on consent, transparency, and accountability. Creators and platforms should reduce harm while still allowing legitimate creative, educational, and journalistic use.
Label and track synthetic content
AI-generated or edited media should be clearly labeled. Where possible, creators should also use watermarking and provenance metadata to show how the content was made, who created it, and whether it has been altered.
Support shared standards
Open, interoperable standards make it easier for provenance information to remain attached across platforms and formats. This works best when platforms, creators, and standards bodies follow common labeling and verification practices.
Recognize the limits
Watermarking is helpful but not foolproof, since determined actors may remove or alter it. Provenance systems can also raise privacy concerns if they reveal too much about creators or subjects.
Practical guidance for creators
Label synthetic content clearly, add provenance information where feasible, and always obtain consent when real people are depicted in intimate, sensitive, or potentially harmful contexts.
Summary
Deepfakes have legitimate uses, but they are no longer just a future threat. They are already causing real harm in the present. They can empower criminals, enable political manipulation, and inflict profound personal harm. As deepfakes become more realistic, scepticism, verification, and the use of detection tools are essential.
The most important principles:
- Be skeptical of emotionally charged or urgent videos.
- Verify through trusted channels before acting.
- Use detection tools when in doubt.
- Never rely on a single source of truth.
In the UK, creating or sharing a non-consensual intimate deepfake is a criminal offence. Other deepfake harms, such as fraud, harassment, intimidation, or impersonation, may also fall under other laws depending on the facts. If you are affected, report to the police immediately or Report Fraud (formerly Action Fraud) on 0300 123 2040
FAQ
What is a deepfake?
A deepfake is AI-generated synthetic media — video, audio, or image — in which a real person's face, voice, or likeness has been replaced or fabricated by a machine learning model. The result is content that makes someone appear to say or do something they never actually did. The term combines "deep learning" (the AI technique used) and "fake", and first emerged in 2017. Today's deepfakes are built on diffusion models and transformers, making them far more convincing than early versions.
Why are deepfakes dangerous?
Deepfakes are dangerous because they exploit a fundamental human instinct: we are wired to trust what we see and hear. They can be used to commit financial fraud (impersonating a CEO to authorise a wire transfer), spread political disinformation, harass and humiliate individuals through non-consensual intimate imagery, and undermine trust in genuine video evidence — a phenomenon sometimes called the "liar's dividend." In the UK, where bank transfers via Faster Payments are instant and irreversible, the financial consequences can be immediate and severe.
Are deepfakes always video?
No — and this is one of the most important misconceptions to correct. Audio deepfakes are now the fastest-growing threat vector. Voice cloning tools can replicate someone's voice from as little as 30 to 60 seconds of audio, enabling real-time phone scams, fake voicemail messages, and fraudulent authorisation calls. The UK has seen a rise in "family emergency" scams where a cloned voice impersonates a relative in distress to prompt urgent bank transfers.
Are deepfakes always fake?
Not in the way the name suggests. Take the "Malaria Must Die" campaign, where David Beckham appeared to deliver a passionate anti-malaria message in nine different languages. That video was a deepfake — but nothing about it was deceptive. Beckham consented to it, the cause was real, and the message was clearly labelled as synthetic. The deepfake was simply a tool to amplify something true.
What makes a deepfake "fake" is not the technology but the intent and context. In most harmful deepfakes, the face or voice belongs to a real person — what has been fabricated is what they appear to be saying or doing. The person is real. The event is not.
The more dangerous consequence is what researchers call the "liar's dividend": because deepfakes are now widely known to exist, anyone caught on camera doing something genuinely incriminating can simply claim the footage is AI-generated. Deepfakes don't just create false content — they cast doubt on true content too, which may ultimately be the more corrosive harm.
How can I tell if something is a deepfake?
The visual tells that worked in 2020 — unnatural blinking, bad teeth, flickering edges — have largely been engineered out of modern deepfakes. In 2026, context is more reliable than pixels. Ask yourself: Does this arrive through an unusual channel? Is there urgency or a pressure to act quickly? Does the audio-visual match feel slightly off in rhythm or breathing, even if the lip-sync looks right? For high-stakes situations — a request for money, sensitive information, or a major announcement — always verify through a separate, trusted communication channel before acting.
Are deepfakes illegal in the UK?
Some uses are now criminal offences in the UK. The Online Safety Act 2023 criminalised the sharing of non-consensual intimate deepfakes. Subsequent legislation went further by criminalising the creation of such content, even without distribution. Beyond intimate imagery, deepfakes used for fraud, impersonation, or harassment can also attract criminal liability under existing laws. Penalties include unlimited fines. The law is still developing, so if you are a victim, seek legal advice and report to both the platform and Action Fraud. Creating or sharing a non-consensual intimate deepfake is a criminal offence. Other deepfake harms, such as fraud, harassment, intimidation, or impersonation, may also fall under other laws depending on the facts. If you are affected, report to the police immediately or Report Fraud (formerly Action Fraud) on 0300 123 2040
Can deepfake detection software be trusted?
Detection tools are useful but not definitive. They should be treated as one signal among several, not as final proof. Common failure modes include: detectors trained on older AI models failing to catch fakes made with newer ones; social media compression triggering false alarms on genuine footage; and adversarial manipulation designed to evade detection. Best practice is to run multiple tools, compare results, and always combine technical analysis with contextual verification and, where stakes are high, human expert review.
What should I do if I receive a suspicious video or voice message?
Do not act on it immediately — especially if it involves a request for money, passwords, or urgent action. Verify the message by contacting the supposed sender through a completely separate channel (call them on a known number, not one they provided). Save the original content, URLs, and timestamps as evidence. If the content is sexual, threatening, or involves impersonation, report it to the platform using their abuse reporting tools and, if a crime may have been committed, report to the police or Report Fraud (formerly Action Fraud) on 0300 123 2040.
Can ordinary people be targeted by deepfakes?
Yes, and increasingly so. While early deepfakes targeted celebrities due to the volume of publicly available footage, today's tools require far less source material. Voice cloning can work from a short social media video. Face-swap tools can work from a handful of photos. Everyday people are targeted through investment scams, "family emergency" fraud calls, non-consensual intimate imagery, and identity theft. Anyone with a visible online presence is potentially at risk.
Are deepfakes ever used for good?
Yes. When used transparently and with consent, the underlying technology has genuine benefits. Medical researchers use synthetic imagery to train diagnostic AI without exposing patient data. Voice cloning gives people who have lost the ability to speak a way to recover their original voice. Educators use synthetic historical figures to create immersive learning experiences. The "Malaria Must Die" campaign used a deepfake of David Beckham to deliver a multilingual health message to global audiences. The ethical line is consent, transparency, and purpose.
What is the single best defence against deepfakes?
No single tool or technique is sufficient on its own. The most effective defence combines three things: a sceptical mindset (treat urgency and emotionally charged content as warning signs, not reasons to act faster); verification habits (always confirm unusual requests through a separate trusted channel); and basic digital hygiene (limit the publicly available audio and video of yourself, use strong account security, and know how to report suspicious content on the platforms you use). Awareness is your strongest asset — deepfakes thrive in confusion.
Deepfakes thrive in confusion. Awareness and vigilance are your strongest defence.
Helpful Links & Support Resources (UK-Focused)
Immediate Reporting & Emergency Help
- Report Fraud (formerly Action Fraud) – National centre for reporting fraud, cybercrime, and deepfake-related scams (e.g., voice cloning or impersonation leading to financial loss): Website: www.reportfraud.police.uk Phone: 0300 123 2040 (England, Wales, Northern Ireland) For Scotland: Call Police Scotland on 101.
- 999 – If you are in immediate danger, being threatened with violence, or the situation is an emergency.
- 101 – Non-emergency police contact (report harassment, threats, or non-urgent crimes).
Intimate Image Abuse & Deepfake Pornography (NCII) Support
- Revenge Porn Helpline – Confidential specialist support for adult victims (18+) of intimate image abuse, including deepfakes. Advice on removal, emotional support, and next steps. Open Monday–Friday 10am–4pm. Phone: 0345 6000 459 Email: help@revengepornhelpline.org.uk Website: revengepornhelpline.org.uk Anonymous reporting option via Whisper: Available on their site.
- Stop NCII – Free hashing tool to help prevent non-consensual intimate images (including deepfakes) from being uploaded/shared across platforms. Website: stopncii.org
General Crime & Victim Support
- Victim Support – Free, confidential help for anyone affected by crime, including deepfake harassment or fraud. No need to report to police first. Supportline: 0808 16 89 111 (24/7) Website: victimsupport.org.uk
- National Domestic Abuse Helpline (Refuge) – For deepfake abuse linked to domestic or coercive control. Phone: 0808 2000 247 (24/7)
Cyber Security & Verification Guidance
- National Cyber Security Centre (NCSC) – Official advice on spotting and defending against deepfakes, AI scams, and verification techniques. Includes guidance on preserving evidence and secure AI practices. Website: ncsc.gov.uk (search for "deepfake" or "AI security")
- Ofcom – UK regulator for online safety under the Online Safety Act. If a regulated service fails to deal properly with illegal content or complaints, you can raise concerns through Ofcom’s online safety complaint routes. Users should usually report the content to the platform first. Website: ofcom.org.uk (online safety section)
Platform Reporting
- Report directly via the platform’s abuse/harassment tools (YouTube, Meta/Facebook/Instagram, TikTok, X, etc.). Many now support C2PA provenance checks and have specific deepfake/synthetic media reporting options.
- For urgent takedowns, combine with platform escalation and the Revenge Porn Helpline or police.
Additional Specialist Support
- Safeline – Support for image-based sexual abuse and deepfake pornography. Website: safeline.org.uk
- Citizens Advice – Help with consumer scams, financial fraud, and legal rights. Website: citizensadvice.org.uk or call 0800 144 8848 (England/Wales).
- Police.uk Deepfakes Page – Official guidance on what constitutes illegal deepfakes and how to report. Website: police.uk/advice/.../deepfakes
For Businesses & Organisations
- NCSC guidance on executive impersonation and deepfake fraud prevention.
- Contact your bank/financial institution immediately if money has been lost or requested.
- Consider forensic partners or retained legal experts for high-stakes incidents.
Notes
- Always preserve evidence (screenshots, URLs, timestamps, original files) before reporting.
- Laws evolve quickly — the creation of non-consensual intimate deepfakes became a specific criminal offence in early 2026 under the Data (Use and Access) Act 2025.
- Support is confidential where noted. If you are supporting someone else, encourage them to contact services directly.