Deepfake (Security)

A deepfake is media generated or altered by machine learning so that it convincingly shows a real person saying or doing something they did not. It can be a swapped face, a cloned voice or a fully synthetic video.

Why it matters

Trust in voices and faces has long supported verification, such as a manager's phone call or a video meeting. Deepfakes weaken that assumption. In security they feature in fraud, impersonation of executives, fake identity checks and misinformation campaigns. The technology is also used legitimately in film, accessibility and research.

Example

An employee gets a voice message that sounds exactly like a director asking for an urgent payment. The organisation's rule is that payment changes must be confirmed through a second channel, such as calling a number held on file. The call-back reveals that the director sent no message.

Common misconceptions

• "I can always tell by looking." Quality improves quickly, and detection tools are imperfect.
• "Only celebrities are targeted." Ordinary staff and customers can be impersonated too.
• "Detection software is the only defence." Process controls, such as call-backs and approval limits, matter as much.

Related

• Social engineering
• Vishing
• Artificial intelligence
• Generative AI

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.