For most of history, seeing was believing.
A photo was evidence. A voice on the phone was the person. A video call with your manager was, obviously, your manager.
That assumption is gone. Generated images, cloned voices and synthetic video are now cheap enough to be used in everyday fraud, not just in lab demos. And the people building scams have noticed.
So the fear — “What if I can no longer tell real from fake?” — is not paranoia. It is an accurate reading of the situation.
Here is the uncomfortable part: you probably won’t win by spotting the fake. Detection tricks age quickly. The weird hands, the odd blinking, the robotic voice — each generation of tools fixes the flaws the previous one had.
You win by changing the question.
Stop asking “Is this real?”. Ask “What is this asking me to do?”
Almost every scam, old or new, ends with a request:
- send money or change bank details;
- share a code, a password or a document;
- click, install, log in;
- keep it secret, and do it now.
The deepfake is just the packaging. The request is the payload. And the request is where you can stop it, whatever the packaging looks like.
The warning signs are behavioural, not visual
Forget pixels. Look at the pattern:
- Urgency. “It has to be done in the next hour.” Pressure exists to stop you thinking.
- Secrecy. “Don’t mention this to anyone yet.” Real requests rarely need to bypass colleagues.
- A change of channel. A message from an unknown number, a new email address, “my phone is broken, use this one”.
- A change of procedure. New IBAN, unusual approval path, a payment outside the normal flow.
- Emotional pressure. Fear, flattery, a family emergency, an authority figure who is “very disappointed”.
One of these signs is a reason to slow down. Two together are a reason to stop.
The pause: a three-step routine
1. Don’t act inside the same conversation. Whatever the request, don’t complete it in the call, chat or email where it arrived.
2. Verify through a channel you already had. Call back on the number saved in your contacts or in the company directory — not the one in the message. Write to the address you have always used. Walk to the person’s desk if you can.
3. Ask something only the real person would know. Not public information. A recent shared detail, an internal reference. Families can agree on a simple code word for emergencies; teams can agree that payment changes are never approved by phone alone.
If the request is genuine, the pause costs you a few minutes. If it isn’t, it saves you everything.
For organisations: make the pause the rule
Individuals get tired, distracted, pressured. Processes don’t. The strongest defence is a rule that nobody is allowed to break, even for the CEO:
- payment detail changes always verified through a second, pre-existing channel;
- no urgent transfers authorised by a single person on a single call;
- a clear, blame-free way to say “I think this is a scam” and escalate.
In the security work that frameworks like NIS2 push organisations towards, the human layer is part of the perimeter. A good procedure turns every employee from a target into a checkpoint.
Trust isn’t dead. It moved.
We used to place trust in what we saw and heard. Now we have to place it in how we verify. That sounds colder, but it isn’t: a family code word, a callback habit, a team that never rushes a payment — these are forms of care.
The fake can look perfect. It still can’t pass a pause.
Your first step
Today, agree on one verification rule with one person: a code word with your family, or a callback rule with the colleague who approves payments with you. One rule, one person. That’s your first line of defence.
Back to Surprise Me — choose another fear to name.
Leave a Reply