How to Spot a Deepfake: Video, Audio and Image Clues That Still Work

Your finance manager gets a video call from the CEO asking for an urgent wire transfer. A parent gets a panicked voice message that sounds exactly like their teenager. A clip of a local official saying something outrageous spreads on social media. Any of these could be a deepfake, and the people targeted often have only minutes to decide.

This guide covers the clues that still give deepfakes away in video, audio and images, and, more importantly, the verification habits that work even when the fake looks and sounds perfect.

What a deepfake is and why it matters now

A deepfake is synthetic media, video, audio or images, created or altered with AI to make someone appear to say or do something they did not. The tools are cheap and widely available, and a few seconds of someone’s voice or a handful of photos can be enough to build a convincing fake.

US agencies have been warning about this for years. The NSA, FBI and CISA described how deepfakes can be used to impersonate executives and gain access to networks and money in their joint guidance Contextualizing Deepfake Threats to Organizations (September 2023). The FBI’s December 2024 public service announcement on generative AI fraud warned that criminals use AI-generated voices, images and video to commit fraud, and noted that AI-generated content is often difficult to identify.

That last point is the key to this whole article: detection by eye and ear is getting harder every year, so your habits matter more than your eyesight.

Video clues: what to look for

Deepfake video has improved fast, but many fakes, especially live ones, still show some of these signs:

• Face edges: Blurring, flickering or color mismatch where the face meets hair, neck or background.
• Eyes: Unnatural blinking, glassy or mismatched eyes, or reflections that do not match the room.
• Mouth and teeth: Lip movements that drift out of sync with speech, or teeth that look smeared or oddly uniform.
• Lighting and shadows: Shadows that fall the wrong way or a face lit differently from the rest of the scene.
• Movement: Stiff head motion, a body that barely moves, or glitches when the person turns sideways or raises a hand to their face.
• Accessories: Glasses, earrings and hats that warp, vanish or merge with skin.

A quick live test: On a suspicious video call, ask the person to turn their head fully to the side, wave a hand in front of their face or hold up a specific object. Real-time face swaps often break down with these movements. Do not rely on this alone, as tools keep improving.

Audio clues: spotting a cloned voice

Voice cloning is now the most common deepfake in fraud, because a phone call needs no video at all. Listen for:

• Flat or odd emotion: The voice sounds right but the emotion does not match the situation, or the tone stays strangely even.
• Rhythm problems: Unnatural pauses, rushed phrasing or breaths in the wrong places.
• Audio quality: Too-clean sound with no background noise, or sudden changes in sound quality mid-call.
• Word choice: Phrases the person being impersonated would never use, or a failure to answer personal questions.
• Pressure: Urgency, secrecy and a request for money, gift cards, crypto or codes. This is the biggest tell of all.

The FBI recommends listening closely to tone and word choice, and agreeing on a secret word or phrase with family members to confirm identity.

Image clues: checking a suspicious photo

AI-generated and AI-edited images can be checked for:

• Hands and feet: Extra or fused fingers, odd joints or distorted feet.
• Text: Garbled letters on signs, labels and clothing.
• Backgrounds: Warped lines, repeating patterns or objects that melt into each other.
• Skin and hair: Overly smooth, plastic-looking skin or hair that blends into the background.
• Physics: Reflections, shadows and perspective that do not add up.

Then do a reverse image search to see where the image first appeared and whether an original, unaltered version exists.

Quick reference: deepfake clues by media type

Key takeaway: Treat visual and audio clues as warning signs, not proof. The reliable defense is verification through a separate channel you already trust.

Verification habits that work when detection fails

These habits protect you even against a flawless fake:

1. Pause on urgency. Pressure to act immediately, keep things secret or bypass normal steps is the strongest signal of fraud, real voice or not.
2. Call back on a known number. Hang up and contact the person or organization using a number you already have or look up yourself. The FBI recommends this approach for suspicious calls.
3. Use a code word. Agree on a secret word with family, and a verification phrase or process for executives and finance staff.
4. Check the source. Where did the clip come from? Is it on the person’s official accounts or reported by credible outlets?
5. Look for content credentials. Some cameras, editing tools and platforms attach C2PA content credentials, tamper-evident metadata that shows how media was created and edited. The NSA and partners described this approach in their January 2025 guidance on strengthening multimedia integrity. Missing credentials do not prove a fake, but present ones add confidence.
6. Never share codes. Do not give one-time passcodes or login details to anyone who contacts you, no matter how convincing they sound.

How businesses can protect themselves

Deepfake fraud against companies usually targets money and access. Build these controls in:

• Payment verification rules. Require a callback to a known number and a second approver for wire transfers, new vendors and changes to bank details, with no exceptions for “the CEO said so.”
• Help desk identity checks. Attackers impersonate employees to reset passwords and multi-factor authentication. Use verification steps that a voice alone cannot pass. Phishing-resistant sign-in such as passkeys also reduces the payoff.
• Training with real examples. Show staff what cloned voices and fake video calls sound and look like, and rehearse what to do.
• Limit public voice and video. Executives with lots of public audio are easier to clone. That is not a reason to go silent, but it raises the importance of verification.
• An incident plan. Know who to call, how to freeze a payment with your bank and how to report it. Our guide to zero trust security explains why no request should be trusted just because of who it appears to come from.

Add deepfake rules to your AI acceptable use policy and security training so they are part of normal operations.

What the law says

This is not legal advice. Federal and state laws increasingly target harmful deepfakes. The federal TAKE IT DOWN Act, signed in May 2025, makes it a crime to publish non-consensual intimate images, including AI-generated ones, and requires covered platforms to remove them within 48 hours of a valid request. The FTC began enforcing the platform requirements on May 19, 2026. Many states also have laws on deepfakes in elections and sexual content.

If you are targeted by a deepfake scam, report it to the FBI’s Internet Crime Complaint Center (IC3) and contact your bank immediately if money was sent.

Conclusion

You can still catch many deepfakes by looking closely at faces, hands, lighting and lip sync, and by listening for flat or rushed speech. But the fakes are improving faster than our eyes. The lasting defense is a set of habits: slow down when pressured, verify through a channel you already trust, use code words and build payment controls that no single call can override.

Sources

• NSA, FBI and CISA, Contextualizing Deepfake Threats to Organizations — how deepfakes are used against organizations and recommended defenses
• FBI IC3, PSA on criminals using generative AI for fraud (December 2024) — visual and audio tells, secret word and callback advice
• NSA and partners, Content Credentials: Strengthening Multimedia Integrity in the Generative AI Era — content credentials for media provenance
• C2PA, Coalition for Content Provenance and Authenticity — open standard for content credentials
• FTC, Complying With the Take It Down Act — platform removal duties and enforcement