Cybersecurity Month · Week 2
Trust nothing. Verify everything.
A familiar face or voice isn’t proof anymore. AI can fake both, so it pays to check before you act.
This week, we focus on deepfakes.
A deepfake is a convincing piece of fake or manipulated media, usually a video, image, or audio recording, created or altered with AI to make someone appear to say or do something they never actually said or did.
Why deepfake attacks work
Deepfake-driven attacks are:
- More convincing
- More personalized
- Faster to deploy
- Harder to detect
- Infinitely scalable
And they’re built to take advantage of:
- Human trust
- Impatience
- Authority
- Urgency
- Familiarity
3 sec
of audio is enough to clone a voice with an 85% match.
How to Spot a Deepfake
The old advice isn’t enough
The old advice was to watch for odd blinking or a warped face. The tools have improved past that, so look for several warning signs together and confirm where the video or call actually came from.
When in doubt, check
You don’t need proof that something was made with AI before you treat it with caution. If a request feels off or out of character, stop and confirm it before you do anything.
1. Look and listen closely
Watch for things that don’t quite match:
- Lip movements that don’t perfectly sync with speech
- Facial expressions that seem unnatural
- Odd lighting, shadows, teeth, hair, hands, or skin texture
- A voice that sounds unusually flat, choppy, or inconsistent
- Changes in tone, accent, pacing, or pronunciation
2. Pay attention to behavior, too
Ask yourself whether this sounds like something the person would normally say or do.
If a CEO, coworker, or family member suddenly says something surprising, check it before you react.
3. Beware of urgency
Be extra careful when a video, call, or message pushes you to:
- Send money
- Buy gift cards
- Share a password or verification code
- Change banking or payment information
- Keep the request secret
- Act immediately
4. Check where it came from
Looking like a real person isn’t enough. Find the original video or announcement on an official website, a verified social account, or another source you trust.
5. Use multiple internal verification methods
If you only follow one tip, make it this one. Say your “boss” calls asking for an urgent wire transfer. Hang up and call them back on a number you already have, or reach them through your usual company channel, and follow your normal approval process for payments.
Make sure everyone knows it’s always okay to question an unusual request, even one that appears to come from the top.
6. Ask for a quick physical check
- Head turns: Ask the person to slowly turn their head to a full side profile. Many deepfake tools are trained on front-facing images and have trouble rendering ears and cheeks.
- Hand waves: Ask them to wave a hand quickly in front of a light. Watch for shadows that flicker or edges that warp.
7. Use phishing-resistant MFA
Passkeys and stronger multifactor authentication make a stolen password far less useful to an attacker.
8. Train employees continuously
A once-a-year training session can’t keep up. Short, regular refreshers help your team recognize new tricks as they show up.
Attackers go after people first. A well-trained team that feels free to double-check is the best protection you have.
Seeing Isn’t Believing Anymore
Most of us assume that if we can see someone on a video call, they must be real. That’s no longer a safe assumption.
This matters most for executives and for finance, procurement, and HR staff, since they’re the ones who receive fake requests that appear to come from leadership.
1
The setup
What happened?
In a recent Huntress Declassified session, security researchers Jim Browning and John Hammond showed a scammer using a real-time deepfake during a live video call.
On a recorded call with a suspected fraud ring, the scammer appeared as a completely different person, with natural expressions and realistic movement. Then they were asked one simple question: “Can you hold up three fingers in front of your face?”
2
The tell
The Three-Finger Test
That’s where it broke down.
When the scammer raised a hand in front of their face, the software couldn’t tell what belonged in the foreground, and the fingers warped and flickered. Real-time deepfake tools have a hard time drawing one object passing in front of another, so this quick request, known as the “Three-Finger Test,” exposes the fake.
Asking someone to turn their head sideways or wave a hand past a light can do the same thing. They’re easy requests to make whenever a video call doesn’t feel right.
3
The takeaway
Why this matters
Deepfakes have moved well past internet novelty. Criminals now use them regularly for identity theft and impersonation scams, and every one of those scams counts on you trusting what you see.
What Resilient Organizations Do Differently
Organizations that avoid these losses have something in common. They build verification into everyday processes, so no one has to decide on the spot whether a request is real. For example:
1
Sending a wire transfer?
Require more than one approval, plus a call back to a number you already have.
Payments
2
Setting up a new vendor payment?
Have two people approve it.
Vendors
3
An employee asking to change their direct deposit?
Confirm with the employee through a second channel, such as a phone call or in person.
Payroll
4
Getting an executive request by video or chat?
Confirm it through a second channel every time, even when it’s urgent.
Leadership
These checks add a minute or two to a process. In return, you know who you’re dealing with, and you catch fraud or mistakes before any money leaves the account.
The bottom line: First impressions can be faked. Checking doesn’t have to be complicated, and it’s the habit that keeps your business safe.
The Numbers Behind the Deepfake Surge
41%
of organizations experienced a deepfake combined with social engineering on an audio call.
10%
of security leaders prioritize deepfake recognition in their awareness programs.
Source: Gartner 2026, via Keepnet
Attackers can impersonate multiple colleagues in a single live call. In 2024, an employee at engineering firm Arup paid out about US$25 million after a video meeting with deepfaked versions of the company’s CFO and coworkers.
Source: Insurance Business
Phishing Has Gotten Scarily Good
For years, we were told phishing emails were easy to spot.
Then
The old red flags
Look for:
- Bad spelling
- Awkward grammar
- Generic greetings
- Strange formatting
Those clues still matter, but they’re no longer enough.
Now
Written to sound like someone you know
AI lets scammers write clean, personal messages in seconds. They pull details from LinkedIn, company websites, social media, and press releases, then write emails that sound like they come from someone who knows you and your business.
Imagine getting an email that:
- References a client you’re working with
- Mentions an event your company recently attended
- Sounds like something your manager would write
- Shows up at a perfectly normal time of day
- Includes enough familiar details to make you think, “This has to be legitimate.”
That’s what makes these emails hard to catch. The usual warning signs often aren’t there.
A well-written email doesn’t tell you much anymore, so change the question. Instead of asking whether an email looks fake, ask:
“Does this request make sense, and can I verify it another way?”
Test Yourself: Spot the Deepfake
See how well you can tell real from fake with these two quizzes from university researchers.
Images and video
Detect Fakes
A research project from Northwestern University’s Kellogg School of Management that began at the MIT Media Lab. Look at real and AI-made images and videos, and decide which is which.
Faces
Which Face Is Real?
Created by researchers at the University of Washington. You see two faces: one real photo and one generated by AI. Can you pick the real person?
Copilot Readiness Assessment
Is your Microsoft 365 ready for Copilot?
Copilot works with whatever it can reach in your environment, including the messy parts: overshared files, stale permissions, and sensitive data in the wrong places. Our readiness checklist shows whether your tenant is organized, secure, and mature enough to put AI to work safely.