A deepfake is a picture, video or audio clip made or changed by artificial intelligence so that it looks or sounds like a real person. It is one kind of synthetic media. Criminals can use deepfakes to impersonate people and ask for money or information.
- Also Called2other namessynthetic media · AI-generated fake
- Related Terms3linked entriesSocial engineering · Phishing · Vishing (voice phishing)
What Is a Deepfake?
A deepfake is a picture, video or audio clip made or changed by artificial intelligence (AI). It looks or sounds like a real person or event. A deepfake is one kind of synthetic media, which means media made or altered by software.
How Do Deepfakes Work?
The FBI Internet Crime Complaint Center (IC3) describes how criminals use AI-generated content. Criminals can generate images, such as fake identification documents. They can generate short audio clips that contain a loved one’s voice. They can also generate videos for real-time video chats with alleged company executives, law enforcement or other authority figures.
Why Are Deepfakes a Security Problem?
The NSA, the FBI and CISA, which is the United States cyber defense agency, published a joint information sheet on deepfake threats. In the alert announcing it, the agencies say that threats from synthetic media, such as deepfakes, have increased. They name disinformation operations as a concern. Disinformation is false information spread to influence the public and cause confusion, unrest and uncertainty. The agencies urge organizations to read the sheet for steps to prepare, identify, defend against and respond to deepfake threats.
The IC3 says criminals use AI to make believable messages faster and reach a wider audience. Deepfake voice and video are used to impersonate people and ask for money. This is a form of social engineering, where an attacker tricks a person instead of breaking into a system.
What Does a Deepfake Scam Look Like?
A person gets a phone call that sounds like a relative in trouble, and the caller asks for money quickly. The voice is a clone made by software. The IC3 describes this type of scam as a cloned voice used to impersonate a close relative in a crisis and ask for immediate financial help.
How Can You Spot and Reduce the Risk of a Deepfake?
The IC3 gives these tips:
- Create a secret word or phrase with your family to verify their identity.
- Examine images and video for imperfections, such as distorted hands or unrealistic features.
- Verify who is calling by hanging up and calling the person or organization directly.
- Never share sensitive information with people you have met only online or over the phone.
- Do not send money or other assets to people you do not know.
The FBI and CISA issued a public service announcement on 16 October 2026 (I-101626-PSA). The agencies said cyber threat actors use deepfakes to create new identities and to steal the identities of real people. They advise checking potentially malicious content for content credentials or watermarking.
What Should a Team Do When a Deepfake Request Arrives?
The FBI advice in the 2024 IC3 alert and the FBI and CISA advice in the October 2026 alert turn into a short routine for staff.
- Stop and treat it as unverifiedIC3 says criminals fake executives in live video chats to ask for money.
- Confirm on a second channelHang up and call a number you looked up yourself. IC3 advises confirming sensitive requests this way.
- Look at the contentCheck for odd hands, faces, shadows, lag and voice mismatch, and for content credentials or watermarks.
- Protect the accountsFBI and CISA advise phishing-resistant multi-factor authentication for all services.
- Send it to ITFBI and CISA advise a clear way for staff to pass suspicious messages to IT.
- Report it to IC3IC3 asks for contact details, payment details and how the contact began.
Is a Deepfake the Same as Phishing?
No. Phishing is a trick, often by email, that gets a person to click, reply or give up information. A deepfake is a type of fake content. Attackers can use a deepfake as part of a scam, but the two are different things.
Is Every Synthetic Image or Video a Deepfake?
Not always. Synthetic media is the wider group of content made or altered by software. A deepfake is the case where the content is made to look or sound like a real person or real event.
Our blog has a case on a deepfake video call and wire fraud. Related pages: generative AI, business email compromise and security awareness training.
Also Called.
- Namesynthetic media
- NameAI-generated fake
Questions.
-
What is a deepfake?
A deepfake is a picture, video or audio clip made or changed by artificial intelligence so that it looks or sounds like a real person or event. It is one kind of synthetic media, which means media made or altered by software.
-
How do criminals use deepfakes?
The FBI Internet Crime Complaint Center says criminals can generate fake identification documents, short audio clips with a loved one's voice, and videos for real-time chats with alleged executives or officials, then use them to ask for money.
-
How can I tell if a call or video is a deepfake?
The IC3 advises examining images and video for imperfections such as distorted hands or unrealistic features. It also advises hanging up and calling the person or organization directly, and agreeing a secret word with family.
-
Is a deepfake the same as phishing?
No. Phishing is a trick, often by email, that gets a person to click, reply or give up information. A deepfake is a type of fake content. Attackers can use a deepfake as part of a scam, but the two are different things.
Sources
- 1 Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, FBI Internet Crime Complaint Center (IC3)
- 2 NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats, CISA
- 3 Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials, FBI and CISA (alert I-101626-PSA)
In Our Research
- 1 The Board Meeting That Never Happened: Deepfake Video Calls and the New Wire Fraud August 2026
- 2 Cryptocurrency Scammers Targeted Elon Musk with Deepfake Technology May 2022
- 3 AI cyber threats in 2026: what the FBI and ENISA report October 2026
- 4 ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026
- 5 One Vendor, Eleven Crises: Why Your TPRM Program Has a People Data Blind Spot August 2026
- 6 How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense July 2026