How to spot a deepfake video or a voice-clone call

The honest answer to "how to spot a deepfake" is that you often can't, not by looking. A year ago you could tell people to watch for odd blinking, waxy skin, or a mouth that didn't quite match the words. Those tells get weaker with every model release, and the person scamming your parents will use the newest tool they can find.

So this guide is in two parts. The first is what to look for, because it still catches the lazy attempts. The second is what to do, because that part doesn't expire.

Why your eyes are the wrong defence

A deepfake is not a trick on your eyes. It is a trick on your trust.

When someone you know calls, you skip every check you would run on a stranger. That is the trust boundary being crossed: a familiar face or voice gets the fast lane, and the attacker only needs to be good enough to ride in that lane for a few minutes. They need a clone that holds up on a bad connection, with a panicked story, while you're already reaching for your wallet.

Voice clones make this cheap. A short sample of someone speaking, the sort of thing in any public video, a voicemail greeting, or a reel, is enough to produce a voice that says whatever the attacker types. The scam calls I've read about in India tend to follow one script: a relative in trouble, a police officer or "official" on the line, a demand for money right now, and pressure not to hang up or tell anyone.

The pattern to notice is not the face. It is the combination of urgency plus money plus a request to keep it quiet. Real emergencies rarely come with a ban on calling back.

How to spot a deepfake by eye, and how much to trust it

Use these as a first filter, not a verdict.

• Edges and hair. Look at where the face meets the hair, the ears, and the collar. Cheap swaps smear or flicker there.
• Lighting that doesn't match. The face is lit from the left while the room is lit from the right, or the skin tone shifts when they move.
• Lip sync. Watch for sounds like "p", "b" and "m", where the lips should close fully. Fakes often get these half-right.
• Hands and objects. When a hand or object passes in front of the face, watch for warping or a face that floats over it. Occlusion is still hard for many tools.
• Blinking and eye direction. Too regular, too rare, or eyes that don't track the camera.
• The audio itself. Clones can sound flat, with the wrong emphasis on a name they'd normally say a hundred times a day, and sometimes a faint, constant background hiss.

Several of these: be suspicious. None of them: you have learned nothing. I'd rather say that than pretend last year's checklist still works.

What to do on a suspicious video call

You don't need to be rude. You need to make the model do something it wasn't trained on.

1. Ask them to turn their head fully to the side, slowly. A profile view often breaks face-swap tools because they're trained mostly on front-facing footage.
2. Ask them to wave a hand across their face, or press a finger against their cheek. Watch whether the face warps or lags behind the hand.
3. Ask something only the real person knows, and that isn't on social media. Not "what's your birthday". Try "what did we argue about last Diwali" or "what's the name of the dog from the old house".
4. Say you'll call them back on the number you already have saved. Then hang up and do that. A real person is fine with this. A scammer will invent a reason why you can't.
5. Do not act on money within the call. No transfers, no gift card codes, no "just share your screen". If they need money, they can wait ten minutes for you to verify.

The fourth step is the whole defence. Everything else is a nice-to-have.

Agree a code word before you need one

This is the single cheapest thing on this page, and almost nobody does it.

Sit down with your family, or your small team, and agree a word or a short phrase. It should be something that would never come up naturally and that you've never typed into a chat app. If someone calls in distress asking for money, the other person asks for the word. No word, no money, no matter how real the voice sounds.

What it costs: one slightly awkward conversation and the discipline to use it when you're scared. That second part is the hard bit, which is why you rehearse it once when nobody is panicking. The same logic I wrote about in the post on why recognition is a perishable skill applies here: spotting a fake is a skill that decays, but following a procedure is not.

Do the same at work. If a "director" calls asking for an urgent payment or a password reset, the rule is that nothing moves until a second person confirms it through a channel the caller didn't choose. Slack, the saved desk number, walking over. That costs a few minutes per genuine request, which is fine, because genuine urgent requests are rare.

If you already sent money

First, don't sit with it. Shame is what the attacker is counting on, because it buys them time.

• Call your bank immediately and ask them to stop or recall the transfer. The sooner you call, the better the odds. If it was UPI, contact your UPI app's support as well.
• In India, call 1930, the national cybercrime helpline, and file a report at cybercrime.gov.in. Keep the phone number that called, screenshots, the transaction reference, and the time. If you're elsewhere, use your national cybercrime reporting line; most countries have one.
• Tell the person who was impersonated. Their voice or face is being used, and they may be able to warn others.
• If you shared anything else, such as an OTP, a screen share, or a password, treat the account as compromised and work through the hacked account triage checklist in order, since the order matters.

None of this is a guarantee of getting money back. But the first hour after the transfer gives you the best chance, and every hour you wait makes recovery less likely.

Frequently asked questions

Can a deepfake happen on a live video call, or only in recorded videos? Live. Real-time face-swap tools exist and run on ordinary hardware. The giveaway is usually behaviour rather than pixels: they resist turning their head, keep the camera close, blame a bad connection, and push you to act before the call ends.

How much audio does someone need to clone my voice? Less than you'd like. A few seconds of clean speech from a public video, a voice note, or a recorded call is enough for a usable clone with current tools. The practical response is not to go silent online, which isn't realistic, but to assume your voice is cloneable and build the code word habit anyway.

My parents won't remember a code word. What then? Make the rule simpler: "If anyone calls asking for money or OTPs, hang up and call me on my saved number before doing anything." One rule, no exceptions, including for calls that claim to be me. Write it on a sticky note next to the phone. It works because it doesn't depend on judgement in the moment.

Is there an app that detects deepfakes reliably? Not one I'd trust with a decision about money. Detection tools exist, but the fakes change faster than the detectors. Treat them as one signal and let the callback on a known number be what you rely on.

Does the 1930 helpline work for scams that didn't involve a deepfake? Yes. It is the general cybercrime helpline in India, for any financial fraud carried out online or by phone, deepfake or not. Report at cybercrime.gov.in too, and keep every piece of evidence you have.

---

Tonight, before you forget, pick a code word with the people you'd send money to without thinking. Then save the real numbers for your bank and for 1930 in your phone, so that in the one minute it matters, you're not searching for them.