Staying alert
How to spot a deepfake call, and what to do when unsure
Do not rely on spotting visual or audio flaws. Rely on the request itself: who is asking, what for, how urgently, and whether you can confirm it another way.
Last reviewed against Building, Government Office for Science (UK Government) and The Register. Sources
The starting point
Fakes are hard to see
Sophos's Chester Wisniewski told The Register that audio calls can now be generated in real time, and that real-time video of a specific person is incredibly expensive [7]. None of the sources used on this site gives a reliable list of visual or audio flaws to look for. Training that depends on spotting glitches is likely to age quickly as tools improve.
Signals
What to notice instead
Urgency and secrecy
Report Fraud describes callers who claim an urgent situation and ask for a payment [9]. A push to hurry or keep quiet is a reason to slow down, not a reason to comply.
An unusual channel or request
Notice when a senior person uses a different route from normal, or asks for something that does not match how payments are usually made. The NCSC advises that staff know the normal processes so unusual requests stand out [8].
Discouraging a check
A caller who resists being called back, or says they cannot be reached another way, is asking you to skip the control.
What to do
In the moment
-
1
Stay polite and say you will confirm and come back to them. -
2
End the call or meeting. -
3
Ring the person back on a number you already hold [9]. -
4
If you cannot confirm, do not act, and tell your manager or security lead. -
5
Report the attempt, even if you did nothing, so others are warned [8].
No blame
The NCSC says staff should not be reprimanded for struggling to spot phishing, because fear of punishment discourages prompt reporting [8]. The same applies to fake calls. Praise the pause, not the guess.
Limits
Why detection tools are not the answer yet
The government is testing detection tools and plans for the results to set industry standards [2]. Until those exist, treat any tool as an extra layer. See can deepfakes be detected and payment approval checks.
Keep reading
Read next
If money has gone
Practical steps for a UK organisation that has paid a criminal after a fake call or video meeting: bank, police, records, staff and review.
Read the guide
What is it?
What deepfake fraud is, how it differs from ordinary phishing and invoice fraud, and the forms it takes against UK organisations.
Read the guide
How common?
How common deepfake fraud is: the government estimate of deepfakes shared, a Gartner survey, UK Finance totals and what none of them can tell you.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Deepfake fraud is stopped by decisions about who may release money or access and how a request is confirmed. A virtual CISO helps leaders set those rules and have them tested, without a full-time hire.