Deepfake: how to spot an AI-generated fake video (7 signs)

Deepfake fraud in Brazil grew 126% between 2024 and 2025, according to reporting by the newspaper Estado de Minas — the country already accounts for roughly 39% of all deepfakes detected in Latin America, and the pattern repeats in every region where the tooling has become cheap. A video that "proves" someone said something, or that confirms the identity of the person on the other end of a call, no longer guarantees anything.

The good news is that the technology still fails in predictable ways. Here are the signs that continue to give a deepfake away in 2026.

What a deepfake is, technically

How is a deepfake generated?

A deepfake uses neural networks trained on real photos and videos of a person to generate new synthetic images or audio that imitate their face and voice. The model learns patterns — face shape, the way someone blinks, vocal timbre — and then reproduces them in a new context, such as a video call the person never made.

The more public material a victim has (YouTube videos, livestreams, interviews), the better the result — which makes executives, content creators and politicians particularly easy targets.

7 signs that still give a deepfake away

• Hands and fingers: still generative AI's number one weak point. Wrong number of fingers, odd proportions, or fingers that merge into each other in certain frames.
• Irregular blinking: eyes that blink too much, too little, or in a pattern that doesn't look human — the model struggles to replicate the natural frequency of blinking.
• Lip sync: lips slightly behind or ahead of the audio, especially in fast speech or words with hard consonants.
• Body stiffness: head movement disconnected from the torso, posture that's too static, missing the natural micro-movement of someone speaking live.
• Edges and hair: loose strands of hair, glasses and earrings tend to "shimmer" or deform subtly across frame transitions.
• Inconsistent lighting: shadow on the face that doesn't match the light source in the background environment.
• Distribution context: a video with an explosive statement circulating only on social media, with no coverage from any news outlet, is a red flag — even if the visual quality is perfect.

Audio deepfakes: the most common scam

While video deepfakes still demand more processing and are easier to catch, AI voice cloning is already accessible enough for mass-scale scams. It's the basis of the fake-relative scam — the "virtual kidnapping" in which criminals call posing as a child or grandchild in trouble, using a voice cloned from the victim's public social media videos. We break that specific scam down, and how to shield yourself from it, in the post on the fake-relative scam with a cloned voice.

The same technical principle is used in corporate fraud too: at the engineering firm Arup, in Hong Kong, an employee transferred US$25 million after an entire video call with deepfakes of several company executives — synthetic voices and faces of people he already knew. We cover that case in the post on CEO fraud with deepfakes.

What to do when in doubt

• Hang up and call back using the number you already have saved — never the number that called you or the one in the message you received.
• Agree on a code word with close family to confirm identity in a genuine emergency.
• Be suspicious of extreme urgency. Every AI scam — deepfakes included — depends on psychological pressure so the victim has no time to check. That mechanism is the same one described in the post on social engineering: no antivirus stops a scam that manipulates human decision-making directly.
• Ask for a live gesture in suspicious video calls — passing a hand in front of the face still breaks a good share of real-time deepfakes, which don't handle sudden occlusion.

The most reliable sign is still behavioral

None of the seven technical signs is infallible on its own — the models improve with every generation, and some already fix the hands and blinking problems. What doesn't change is the shape of the scam: a request for money or sensitive data, artificial urgency, and a communication channel you didn't choose. If those three elements show up together, stop and verify through an independent channel before acting — no matter how convincing the voice or face on the other side looks.

To harden your defenses against this kind of manipulation more broadly, it's worth pairing this with the definitive OPSEC and privacy guide.