Deepfake.

What is a deepfake?

A deepfake is a picture, video or audio clip that has been made or changed by artificial intelligence (AI) so that it looks or sounds like a real person or event. A deepfake is one kind of synthetic media, which means media made or altered by software.

How do deepfakes work?

The FBI Internet Crime Complaint Center (IC3) describes how criminals use AI-generated content. Criminals can generate images, such as fake identification documents. They can generate short audio clips that contain a loved one’s voice. They can also generate videos for real-time video chats with alleged company executives, law enforcement or other authority figures.

Why are deepfakes a security problem?

The NSA, the FBI and CISA, which is the United States cyber defense agency, published a joint information sheet on deepfake threats. In the alert announcing it, the agencies say that threats from synthetic media, such as deepfakes, have increased. They name disinformation operations as a concern. Disinformation is false information spread to influence the public and cause confusion, unrest and uncertainty. The agencies urge organizations to read the sheet for steps to prepare, identify, defend against and respond to deepfake threats.

The IC3 says criminals use AI to make believable messages faster and reach a wider audience. Deepfake voice and video are used to impersonate people and ask for money. This is a form of social engineering, where an attacker tricks a person instead of breaking into a system.

What does a deepfake scam look like?

This is a simple illustration. A person gets a phone call that sounds like a relative in trouble, and the caller asks for money quickly. The voice is a clone made by software. The IC3 describes this type of scam as a cloned voice used to impersonate a close relative in a crisis and ask for immediate financial help.

How can you spot and reduce the risk of a deepfake?

The IC3 gives these tips:

• Create a secret word or phrase with your family to verify their identity.
• Examine images and video for imperfections, such as distorted hands or unrealistic features.
• Verify who is calling by hanging up and calling the person or organization directly.
• Never share sensitive information with people you have met only online or over the phone.
• Do not send money or other assets to people you do not know.

Is a deepfake the same as phishing?

No. Phishing is a trick, often by email, that gets a person to click, reply or give up information. A deepfake is a type of fake content. Attackers can use a deepfake as part of a scam, but the two are different things.

Is every synthetic image or video a deepfake?

Not always. Synthetic media is the wider group of content made or altered by software. A deepfake is the case where the content is made to look or sound like a real person or real event.