What is a deepfake and how can you tell? A responsible-use guide

Short answer: a deepfake is AI-generated or altered image, audio or video that resembles a real person, place or event and looks authentic. The technology is also used in fun and creative work; harm arises when it is used without a person's consent or to deceive. This article explains the definition, the main harms, how to check whether content is real and what responsible use means. It is not legal advice.

What exactly is a deepfake?

The EU Artificial Intelligence Act defines a "deep fake" as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. A joint information sheet from the NSA, FBI and CISA treats deepfakes as media synthetically created or manipulated using machine learning or deep learning technology. The common point: the content is artificial and looks real.

Not every AI image is a deepfake. An obviously imaginary scene, a cartoon-style image or a landscape that resembles nothing does not try to pass for reality. The problem is imitating a real person's face, voice or words in a way that will be taken for real.

What harms can deepfakes cause?

• Fraud: According to an FTC alert, a short audio clip of a relative's voice shared online and a voice-cloning program are enough for scammers; they call with an "urgent money needed" story.
• Impersonation against organizations: The NSA, FBI and CISA sheet lists threats to brands, impersonation of executives and financial officers, and fraudulent communications used to gain access to networks among the main threats.
• Misinformation: A video or audio clip showing an event that did not happen can influence people's decisions.
• Reputation and privacy harm: Showing someone, without consent, saying something they never said or doing something they never did can lead to harassment, blackmail and loss of reputation.

The NSA, FBI and CISA sheet notes there are limited indications of significant use by malicious state-sponsored actors, but that less capable actors are gaining easier access to these techniques, so use is likely to grow.

How can you tell whether content is a deepfake?

There is no certain method. Clues such as inconsistencies in the face, fingers, ears, teeth and lighting, lip and voice mismatch, or a strange background sometimes help, but as models improve these clues fade. So instead of relying on the naked eye, verifying the source and context is more robust.

Method	What it helps with	Limit
Check the source	Who shared it, where did it first appear, is there a reliable outlet?	A trustworthy-looking account may also have shared it
Question the context	Is the event reported in other reliable sources?	For new events, verification takes time
Look at visual clues	Inconsistencies in hands, teeth, text, shadows, light	Good models may show none of these
Reverse image search	Whether the image derives from an older photo	Finds nothing for new generations
Provenance signals	Content credentials (C2PA), watermarks	Signals can be removed; their absence does not prove content is real
Call back (for audio)	Call the person on a number you know	If you cannot reach them, verify through another relative

C2PA is a coalition developing open technical standards for content provenance and authenticity; the Content Credentials page describes a mark showing that content carries provenance information and lets viewers review how it was made and its editing history. The page also acknowledges that bad actors will keep trying to label synthetic content as authentic. So these marks help, but they are not conclusive proof.

What should you do against voice scams?

The FTC's advice is clear: do not trust the voice; call the person on a number you know to verify the story; if you cannot reach them, try through another family member or friend; be careful with payment requests that are hard to reverse, such as wire transfers, cryptocurrency or gift cards. If you spot a scam, report it to the relevant authority.

What does responsible use look like?

• Consent: If you will use a real person's face, voice or likeness, get clear permission first.
• Do no harm: Do not create content that humiliates, deceives, harasses or shows someone as an accomplice to a crime.
• Openness: When you share a realistic scene, say that it is artificial.
• Political and public figures: Avoid especially content that could be taken as real in election and news contexts.
• Children: Do not create this kind of content with children's images.

What does the law say? The EU AI Act example

Article 50 of the EU AI Act sets transparency obligations. Under Article 50(4), organizations that use a system to create or alter a deepfake and publish the content (deployers) must disclose that the content has been artificially generated or manipulated. Where the work is evidently artistic, creative, satirical or fictional, the obligation is limited to disclosing the existence of the content in an appropriate manner that does not hamper the display or enjoyment of the work. The European Commission's FAQ page says the obligations for systems under 50(2) and 50(4) apply from 2 August 2026, with a transitional period until 2 December 2026 for systems placed on the market before that date, and that a code of practice has been published covering design and placement of deepfake labels. For details, see our article Labelling AI content. Rules in your own country may differ; this is not legal advice.

What should you do if you run into a deepfake?

1. Do not share it; spreading it increases the harm.
2. Check the source and context.
3. Report the content with the platform's reporting tool.
4. If there is personal harm, keep a screenshot and the link as evidence.
5. If there is fraud or blackmail, contact the authorities and your bank; agencies such as the FTC have reporting lines.
6. If you or someone close to you is the target, get legal support.

What precautions can you take in the family and at work?

The NSA, FBI and CISA sheet recommends both technical and non-technical measures for organizations: detection and provenance tools, protecting the communications of high-priority officers, information sharing, planning and rehearsing responses to exploitation attempts and training personnel. You can adapt these suggestions to your own scale.

• A second-channel rule for money requests: verify any request for money or an account change that arrives by message, voice or video through another channel you know.
• Slow down under urgent pressure: scammers use haste; a "send it now" push is a warning sign.
• Talk in the family: especially with older relatives, explain that voice-cloning scams exist and agree on a shared way to verify; this is general practice advice.
• Write a procedure at work: who approves which request through which channel should be written down.
• Think about your own footprint: voice and video recordings you share publicly can be raw material for imitation; review what you post.

Common mistakes

• Trusting the eye: A good deepfake may not be noticeable by eye.
• Sending money because you recognize the voice: Voices can be cloned; always call back.
• Saying "no watermark means real": Marks can be removed or never added.
• Making content without consent as a joke: Harm does not depend on intent.
• Sharing without verifying: Misinformation spreads fast.

How reliable are labels and marks?

Seeing a "generated with AI" label on content is a useful clue, but the absence of a label does not prove content is real; bad actors do not add labels or try to strip marks. The reverse also holds: a label can be fake visually. So place labels beside, not instead of, checking the source and context. For labelling rules, see our article Labelling AI content.

Summary

• A deepfake is AI-generated or altered content that looks like a real person or event.
• Fraud, impersonation, misinformation and reputation harm are the main risks.
• Spotting by eye is unreliable; source, context and calling back are more robust.
• Content credentials and watermarks help but are not conclusive.
• Responsible use means consent, doing no harm and saying it is artificial.