Deepfakes Explained: How to Spot Fake Videos and Images

Early in 2024, a finance worker at the Hong Kong office of Arup, a British engineering firm, got an email, apparently from the company’s UK office, asking for a confidential transaction. He suspected phishing. Then he joined a video call where the chief financial officer and other colleagues looked and sounded just like themselves, and he put his doubts aside. All of them were deepfakes. He sent HK$200 million, about US$25.6 million, in 15 transfers, according to police accounts reported by CNN.¹

How to spot a deepfake, in short: don’t start with the pixels. When researchers from Germany and the US pooled studies of human deepfake detection in 2024, people did not reliably beat chance at picking out the fakes.² Checks that don’t depend on your eyesight work better. Use them in this order:

1. Check the source and the context: who posted it first, and is it asking for money, secrecy or speed?
2. Run a reverse image search on a screenshot, looking for older copies
3. Look for glitches, knowing they are fading
4. Look for a Content Credentials label, and read what it does and doesn’t say

What a deepfake is, and how one gets made

A deepfake is a photo, video or sound file of a real person, made with artificial intelligence (AI) to show them doing or saying something they never did. That is the definition used by Australia’s eSafety Commissioner, which adds that the software learns from real photos or recordings of the person and often needs only a small amount of them.³ Deepfakes are a branch of generative AIgenerative AI: AI systems that produce new text, images, audio or code in response to a request, by generating output that resembles the data they were trained on. Chatbots built on large language models are the best-known kind.Full entry in the glossary, the family of software behind chatbots; why AI chatbots make things up explains how such systems produce confident, convincing errors.

A big leap in deepfake quality came from a design called a generative adversarial network. Europol, the European Union’s law enforcement agency, describes it as two competing AI models: one creates content, the other judges whether it looks like the real examples, and both improve until the judge can no longer tell them apart. The recipes include putting one person’s face on someone else’s body, copying one person’s expressions onto another face, or generating a person who never existed. Early deepfake faces did not blink, because the people in the photos they learned from generally had their eyes open; adding videos of people blinking to the training data fixed it.⁴

So every giveaway that gets publicized becomes something the next version learns to avoid. Treat any single tell you read about, including the ones later in this guide, as having a short shelf life. What lasts are the everyday digital safety habits: slow down, and confirm the story through a channel you already know.

Where you are likely to meet a deepfake

Agency warnings and news reports keep pointing to four places: investment ads that borrow a famous face, political clips, video calls from someone posing as a boss or official, and sexual images made without consent.

Celebrity investment ads borrow a trusted face to sell. In 2023 a Facebook ad showed a computer-generated likeness of Martin Lewis, a well-known British consumer finance expert, urging viewers into a scheme supposedly backed by Elon Musk. Lewis told the BBC that he does not advertise and does not do investments.⁵ Underneath, the pitch is the same as in the passive income scams that promise easy returns.

Political clips aim at crowds rather than wallets. In March 2022, during the war with Russia, a deepfake of Ukraine’s president Volodymyr Zelenskyy telling soldiers to lay down their arms spread on social media and was placed on a hacked Ukrainian news website. Viewers noticed that his accent was off and his head and voice looked wrong, platforms removed it, and Zelenskyy posted a video response.⁶ That fake was crude; better ones may not be caught so fast.

The FBI’s public warning covers the other two. It lists live video chats with supposed company executives, police or other authority figures among the ways criminals use AI video, as in the Arup case, and says criminals make fake sexual photos of victims to demand payment.⁷

Across all four, the deepfake is the wrapping. The request inside is to pay, to share, to act fast or to keep quiet, and you can check a request without judging a single pixel.

Why your eyes are a weak deepfake detector

People are poor at spotting deepfakes by looking, and most don’t know it. The strongest evidence is a 2024 meta-analysismeta-analysis: A study that combines the results of earlier studies on the same question into one overall estimate. Pooling makes the estimate more precise, but it cannot repair the studies it pools: a meta-analysis of surveys is still survey evidence.Full entry in the glossary from Germany’s University of Duisburg-Essen and Indiana University in the US, which pooled studies that tested people on deepfake video, images, audio or text.

The study

Moderate evidence

Can people tell deepfakes from real media? Diel and colleagues, 2024

The review combined 56 papers with more than 86,000 participants. People correctly flagged about 55.5% of the fakes, and because the uncertainty range crossed 50%, the authors concluded that detection did not reliably beat chance for any type of media. Where studies added training with feedback, AI support or exaggerated “caricature” versions of fakes, pooled detection of fakes was above chance.²

When a clip is fake, a typical viewer catches it little more often than a coin flip would, and people are better at confirming real clips than at catching fakes. The authors note that the studies varied widely in material, samples and methods.² The result also describes judging media in a test, not in everyday life, where you may have more context or less time.

Confidence makes it worse. In a 2021 online experiment run by Nils Köbis and colleagues from Berlin and Amsterdam, 210 volunteers, most of them in the UK, got just over half of a set of real and deepfake videos right. Neither a warning about deepfakes nor a cash reward for accuracy helped, people tended to call fakes real, and they believed they had done better than they had.⁸ That is overconfidenceoverconfidence: Being more sure of your knowledge, skill or forecasts than the results justify, for example rating yourself above average or giving too narrow a range for an estimate. It is broader than the Dunning-Kruger effect, which is about how the error varies with skill.Full entry in the glossary, so count your own feeling of certainty about a clip as no evidence at all.

Still images are no easier. In a 2022 study by Sophie Nightingale of Lancaster University and Hany Farid of UC Berkeley, online crowd workers judged faces made by the AI model StyleGAN2 at chance level and rated them slightly more trustworthy than real faces. The authors suspect some synthetic faces simply have no visible flaw to find.⁹

Part of the reason is how people judge what they see. Europol’s report describes a human predisposition to believe audio and video, a default of trust that it says complicates even careful manual checks.⁴ Picture scrolling late at night past a clip of a politician saying something outrageous: you react to the words long before you think to study the lips.

How to spot a deepfake without relying on your eyes

To spot a deepfake, test the story before the picture. Start with where a clip came from and whether it fits, search for earlier copies, and only then look for glitches and labels, which help only some of the time.

1. Check the source and the context

Australia’s eSafety Commissioner advises questioning the context: is this what you would expect this person to say or do, in that place, at that time?³ Context was people’s edge in a 2021 study led by Matthew Groh at the MIT Media Lab with more than 15,000 online participants, funded by the lab’s member companies. Ordinary viewers performed in the same range as the leading detection software overall, and beat it on deepfakes of Vladimir Putin and Kim Jong-un, which the authors think is likely because people could look past the face and ask whether the video made sense.¹⁰

In practice, find the original. Is the clip on the person’s official account, or reported by an established news outlet? Is the account that shared it new, or recently renamed? For calls and messages, the FBI’s advice is to hang up, look up the organization’s contact details yourself and call back, and never to send money to someone you have met only online or over the phone.⁷

2. Run a reverse image search

A reverse image search shows where else a picture appears online. Google’s Lens, for example, lets you upload an image or paste its web address, and the results can include websites that carry the same or a similar image.¹¹ For a video, search with a screenshot of a clear frame.

You are looking for an older copy with a different caption, the original footage a fake was built from, or a fact-check. Say a clip shows a TV presenter praising a trading app: a search on a screenshot may turn up the same studio shot from an interview about something else. No matches proves little, because a brand-new fake may not have been indexed yet.

3. Look for glitches, knowing they are fading

Glitches still give away cheaper fakes. Australia’s eSafety Commissioner lists blurring or pixelation around the mouth, eyes and neck, patchy skin tone, changes in lighting across a video, badly synced sound, irregular blinking and gaps in speech, and says these signs help mainly with lower-tech fakes.³

Myth

If you look closely enough, you can always tell a deepfake.

Fact

Pooled studies find people catch fakes little more often than chance, and some AI-made faces may have no visible flaw at all.

So use glitches in one direction only. A blurred jawline or lips out of step with the voice is a good reason to stop and check; a clip that looks clean is not a reason to trust it.

4. Look for a Content Credentials label

Content Credentials are a signed record of where a file came from, built on an open standard from the Coalition for Content Provenance and Authenticity (C2PA). The record travels with the file, can describe how it was made and edited, and is tamper-evident. Where it is supported, verified content carries a badge or icon that opens that history. The C2PA is clear about the limits: a credential cannot tell you whether the content is true or accurate, and the data can be removed from a file.¹² A missing label therefore proves nothing either way.

Labels are also spreading by law in some places. Since 2 August 2026, the European Union’s AI ActEU AI Act: The European Union's law on artificial intelligence, adopted in 2024, which sorts AI uses by risk: some practices are banned, high-risk uses such as screening job applicants carry duties, and others need only transparency. Its duties start on different dates.Full entry in the glossary has required a label on deepfakes and a machine-readable mark on content that AI generates or alters.¹³ What the EU AI Act requires of chatbots and deepfakes covers who must label; outside the EU, rules differ.

Before you believe, share or pay

• Find who posted it first and whether it is on the person’s official channels
• Notice whether it asks for money, secrecy or speed
• Confirm through a number or website I already know
• Run a reverse image search on a screenshot
• Look for blur, bad lip sync or odd blinking
• Open any Content Credentials badge and read what it says

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

If a deepfake targets you or someone you know

If someone makes a deepfake of you, keep evidence, don’t pay anyone who threatens you, and report it to the platform and to the police. Australia’s eSafety Commissioner advises people threatened with sexual images, including fake ones, to stop contact, not pay, save evidence, report to the platform, tell someone they trust or call a helpline, and contact their bank if they have already paid.¹⁴ If someone could be hurt right now, call your local emergency number before any of that.

Say a doctored image of you turns up on a social media account. Capture the post, its link and the account name before you do anything else, then use the platform’s report button, then go to the police. If a sexual image shows anyone under 18, record the link and account name but don’t save the image, which eSafety warns is usually illegal.¹⁵

1. 1Save the evidencescreenshots, links, account names, messages
2. 2Report to the platformuse its reporting tool for fake or intimate content
3. 3Report to the policeor your national fraud or cybercrime service
4. 4Ask for removalthrough a takedown service where one applies

For sexual images, two services work across participating platforms without you sending the picture itself. StopNCII.org, for adults, turns the image into a digital fingerprint that is made on your device, and shares it with participating companies so they can detect and remove copies; it accepts nude or semi-nude deepfakes of you if you have a copy.¹⁶ Take It Down, a free service run by the US National Center for Missing & Exploited Children, helps with images taken when the person was under 18.¹⁷ In Australia, the eSafety Commissioner helps people whose images have been digitally altered and posted online to get them removed.³

Laws on deepfakes differ widely by country. The US TAKE IT DOWN Act of May 2025 makes it a crime, in the circumstances it defines, to knowingly publish intimate images of a person without consent, including AI-made forgeries, and requires covered platforms to remove reported images within 48 hours of a valid request.¹⁸ Australia’s 2024 deepfake law makes sharing sexual material of an adult without consent, including material made or altered with AI, punishable by up to 6 years in prison, or 7 if the sharer also made or altered it.¹⁹ Wherever you live, check your own country’s rules with local police or a victim support service.

The bottom line

People tested on deepfakes catch fakes little more often than chance, and in one experiment they felt surer than they should. Reverse image searches, glitches and Content Credentials labels add clues, but none of them settles the question alone. Treat any clip that asks for money, secrecy or outrage as unconfirmed until you have traced its source and checked with the person or organization directly.