Deepfake: What You Need to Know to Stay Safe

In our rapidly evolving digital world, what we see and hear isn’t always what it seems. Artificial Intelligence (AI) has brought incredible advancements, but also new challenges, one of the most prominent being “deepfakes.”

At HyperSecureIT Sàrl, we are committed to keeping our clients, small businesses and NGOs in Geneva and Vaud informed and secure. This guide will help you understand what deepfakes are, how to spot them, and what steps you can take to protect yourself and your organisation from this growing threat.

What is a Deepfake?

Simply put: The Illusion of Reality

The term “deepfake” combines “deep learning” (a type of AI) and “fake.” Essentially, a deepfake is synthetic media, fake images, audio, or videos – created using advanced AI techniques for the purpose of deceiving others.

Unlike simple photo editing or voice changers, deepfakes leverage complex AI algorithms (like Generative Adversarial Networks or GANs), neural networks, and machine learning to learn patterns from vast amounts of real data. Several methods exist for deepfake creation, including face swapping, video manipulation, and audio content generation, which enable the production of high quality deepfakes. This allows them to generate incredibly convincing and realistic depictions of people saying or doing things they never actually did.

Why are deepfakes a concern?

Deepfakes blur the line between truth and fiction. They can be used to:

Spread Misinformation: Fabricate statements from public figures or company executives.
Commit Fraud: Impersonate individuals for financial scams (e.g., a fake CEO call requesting a wire transfer).
Damage Reputation: Create false narratives or embarrassing situations for individuals or organisations.
Enhance Social Engineering: Make phishing attempts or scams far more believable.

Companies face significant risks from deepfakes, including reputation damage, financial theft, and the creation of fake content or new identities that can be used for fraud or to create videos targeting executives.

The many types of deepfakes

While face-swapped videos are the most widely recognised form, deepfake technology extends to various types of media:

Deepfake Videos (Visual Deepfakes):

Face Swaps / Swap Faces: Replacing one person’s face with another’s in existing video footage. This is what you often see with celebrity deepfakes. Some tools can generate a deepfake video from just one image, making the process even more accessible.
Lip-Syncing & Speech-to-Video: Manipulating a person’s mouth movements to match new audio, making it appear as though they are saying something they never said.
Expression Transfer: Copying facial expressions from one person and applying them to another.
Full Body Synthesis: Generating entire human figures or movements that are entirely artificial.
Video Manipulation: Using AI technology to alter or create videos for entertainment, creative storytelling, or other things, but also for malicious purposes.

Deepfake Audio (Voice Cloning/Spoofing):

Creating a synthetic voice that mimics a real person’s voice, tone, and speaking style based on a small audio sample. This can include fake audio and falsified content.
This can be used to make phone calls or voice messages that sound exactly like a trusted individual (e.g., a CEO, a client, or a family member).

Deepfake Images (Still Images):

Generating entirely new, photorealistic images of people who don’t exist, or altering existing photos in highly convincing ways (e.g., Pope Francis in a puffer jacket, or a political leader in a compromising situation).
Deepfake creation and creating deepfakes can involve both images and audio content, and users can easily create videos for entertainment or other things.

Difference: There is a difference between deepfake, face swap, and deepswap technologies, though they are often used interchangeably. Face swapping and swap faces are common techniques, while deepswap may refer to specific tools or platforms.

AI technology enables the creation of manipulated content, including fake audio, falsified content, and high quality deepfakes, using several methods such as neural networks and machine learning.

The impact of deepfakes on businesses & NGOs:

CEO Fraud/Business Email Compromise (BEC) 2.0: A deepfake voice call or deepfake video from a “CEO” instructing an employee to transfer funds to a fraudulent account.
Reputational Damage: A fabricated video showing a CEO making controversial statements that can harm stock prices or public trust.
Identity Theft/Bypassing Biometrics: Using deepfake faces or voices to trick facial or voice recognition systems, sometimes by creating new identities.
Targeted Phishing: Deepfake audio or video used in a spear-phishing attack to make it incredibly convincing to an individual.
Companies have been targeted with deepfake videos and fake content, including false claims and new identities created for fraud.

Examples: High-profile deepfake incidents include the Barack Obama deepfake video featuring Peele’s voice, which demonstrated how convincingly a public figure’s speech can be manipulated. Deepfakes involving Donald Trump have also circulated, with clips spreading on platforms like YouTube and Facebook, highlighting the potential for disinformation and reputation damage.

The dangerous consequences of deepfakes include the spread of fake news, manipulated content, and falsified content on the internet, which can impact public perception, influence elections, and cause significant harm to individuals and organisations. Deepfakes are also used for creative storytelling and entertainment, but have other things applications across industries.

How to Detect a Deepfake – Becoming a Savvy Observer

Deepfake technology is constantly improving, making detection harder. As deepfakes continues to advance, it becomes increasingly difficult for users to spot manipulated content. However, paying close attention to certain cues can help you identify manipulations. Trust your instincts if something feels “off.”

Visual Cues (for Videos/Images):

Unnatural Blinking: Deepfake characters often blink less frequently or have irregular blinking patterns.
Odd Eye Movements: Eyes might seem “dead” or look in unnatural directions.
Inconsistent Facial Features: Look for strange skin textures (too smooth or too wrinkled), unusual teeth that don’t look quite right, or odd-looking hair (e.g., no flyaways).
Mismatched Lighting/Shadows: Lighting on the person’s face might not match the background or change unnaturally as they move.
Inconsistent Body Movements: The head might not sync naturally with the body, or general movements may appear jerky or robotic.
Blurriness/Artifacts: Look for blurry edges around the face or neck, or digital “artifacts” (small glitches) that suggest manipulation.
Asymmetry: While real faces aren’t perfectly symmetrical, deepfakes might have overly obvious or unnatural asymmetry.
Emotional Mismatches: Do their facial expressions align with what they are supposedly saying or the context?

Audio Cues (for Audio Deepfakes):

Unnatural Pauses or Pitch Changes: Listen for choppy speech, unusual hesitations, or sudden shifts in voice pitch or cadence.
Monotone or Robotic Sound: The voice might lack natural human emotion or sound slightly artificial.
Background Noise Inconsistencies: Does the background noise suddenly cut out or sound inconsistent with the environment the person is supposedly in?
Mismatched Lip-Sync (for videos): If watching a video, check if the lip movements perfectly match the audio. Subtle discrepancies are often a giveaway.

Contextual Clues (The Most Important):

Source Verification: Who sent this? Is it from a trusted sender or an unfamiliar email/phone number? Always verify the source.
Unusual Requests: Does the message or video contain urgent, high-pressure requests (especially for money, sensitive data, or changes to payment details)?
Cross-Reference Information: Check if the information is reported by reputable news sources or official channels. If it’s a shocking claim, and only one dubious source has it, be suspicious.
Direct Confirmation: If you receive an unusual request, especially from a “senior executive,” verify it through a different, pre-established secure channel (e.g., a direct call to their known number, not a number provided in the suspicious message).
Gut Feeling: If something feels “off,” trust your intuition and investigate further before acting.
Consider the Story: Evaluate the story behind a video or audio clip to help determine its authenticity—does it make sense in context, or does it seem out of character or implausible?

Protecting your business from deepfakes

Prevention and awareness are your strongest defences against deepfakes. Here’s what HyperSecureIT Sàrl recommends for our clients:

Employee Training & Awareness is Key:

Educate all staff, from entry-level to executives, about deepfakes and their potential uses in fraud and misinformation.
Conduct regular cybersecurity awareness training sessions.
Emphasise the importance of verifying unusual requests through alternative channels.

Implement Robust Verification Protocols:

Multi-Factor Authentication (MFA): Crucial for all critical accounts. Even if a deepfake tricks someone into giving up a password, MFA provides a second layer of defence.
Verification for Financial Transactions: Establish strict protocols for payment transfers or changes to financial details. Always require a secondary verification (e.g., a direct phone call to a known number, or an in-person confirmation) for high-value transactions.
Internal Communication Guidelines: Define clear procedures for how sensitive requests (especially financial or data-related) must be communicated and verified.

Strengthen Email Security:

Use advanced email filtering and anti-phishing solutions that can detect spoofed emails, even if they contain deepfake elements.
Train staff to identify phishing and spear-phishing attempts.

Protect Public-Facing Assets:

Be mindful of the personal and professional information shared online by key personnel (e.g., LinkedIn profiles, public videos). This data can be used to create more convincing deepfakes.
Consider digital watermarking or authenticity standards for official company media if applicable.

Develop an Incident Response Plan:

Know what to do if your organisation is targeted by a deepfake. How will you verify? Who needs to be informed? How will you address public perception if a deepfake related to your business goes viral?

Leverage Cybersecurity Expertise:

Stay informed about emerging deepfake detection technologies. While no single tool is perfect, a layered approach to cybersecurity is essential.
Consider partnering with a managed IT and cybersecurity service provider like HyperSecureIT Sàrl to get expert advice, implement advanced security solutions, and stay ahead of evolving threats.

Regulatory Framework: Be aware that the regulatory framework around deepfake creation and dissemination is evolving. Laws and regulations are being developed to address the risks and dangerous consequences associated with manipulated content and falsified content.

Don’t let deepfakes undermine your trust or compromise your operations. Stay vigilant, stay informed, and stay secure.