Earlier this year a finance worker in Hong Kong transferred $25 million after joining a video call with his CFO and several colleagues. Every person on that call was a deepfake. The faces, the voices, the mannerisms. All AI-generated. He did not question it because it looked exactly like a normal work meeting.
That story stuck with me because I kept thinking about what I would have done in his position. Honestly? I probably would have fallen for it too. When you see your boss's face and hear your boss's voice asking you to do something routine, your brain does not stop to run a forensic analysis. You just do it.
That was a corporate attack worth millions, but the same tools are being used on regular people. Fake profile photos on dating apps. Phishing emails with perfect grammar. Cloned voices calling grandparents pretending to be in trouble. The old "look for bad spelling" advice is dead. AI does not make spelling mistakes.
There are still ways to catch fakes, though. And more importantly, there are habits that work no matter how good the AI gets.
Real-time deepfake video has gotten scary good, but it still messes up in predictable ways. On your next suspicious video call, watch for these:
The best test I have seen: ask them to do something unexpected. "Turn your head to the side for a second." "Hold up three fingers." "Touch your ear." A real person does this without thinking. A deepfake either glitches, freezes, or the person on the other end dodges the request. If they will not do a simple physical thing on camera, that tells you something.
AI image generators are good now. Really good. But they still blow it in the same places over and over:
If you are looking at a profile photo on a dating app or social media and something feels a little off, do a reverse image search. Drag it into Google Images or TinEye. If the photo does not appear anywhere else on the internet and the account is brand new, you are probably looking at an AI-generated face.
This is the hardest one, and I want to be honest about it. AI-generated text is almost impossible to distinguish from human writing at this point. You can not rely on grammar mistakes or awkward phrasing anymore because AI does not make those errors.
So forget about analyzing the writing quality. Focus on what the message is asking you to do.
Voice cloning is probably the scariest one. A cloned voice of a family member calls saying they have been arrested or are in the hospital and need money immediately. We wrote a whole guide on AI voice cloning scams because it is that common.
Deepfake video calls are showing up in romance scams and business fraud. The scammer "proves" they are real by hopping on video, but the video is AI-generated in real time. Some people have been on weekly video calls with someone who does not exist.
AI-generated dating profiles are everywhere now. Fake photos, AI-written bios, and chatbot conversations that feel real for weeks before the person pivots to asking for money or steering you toward a crypto platform.
Phishing emails have gotten noticeably better. No more broken English. AI can write emails that match a company's exact tone, formatting, and terminology. I have seen some that I genuinely could not tell apart from the real thing just by reading them.
And fake reviews. Five-star reviews, video testimonials, comment sections full of praise, all generated. If you are evaluating a product or service and every review sounds polished and enthusiastic, that should make you more suspicious, not less.
I could list tells and detection tricks all day, but the truth is this stuff keeps getting better and the tells keep getting smaller. What does not change is verification. If you verify through a channel you control, it does not matter how good the fake is.
AI can fake faces, voices, and writing. It can not stop you from picking up the phone and calling someone directly to ask "did you actually send this?"
If you received a message that might be AI-generated, run it through the message checker. If it contains a link, check that too.