Detecting deepfakes is soon impossible – but you can still protect yourself

How difficult can it really be to recognise a deepfake? Almost impossible, it seems. A study from iProov points to a rather astonishing result: only 0.1% of participants were able to correctly identify what was fake and what was real in the media they were exposed to. This despite the fact that they knew they would encounter manipulated images and clips. In real life – where we most likely are even less vigilant – chance is probably even lower.

At the same time, confidence is high. Over 60% of participants believed they could identify deepfakes. The overconfidence was highest among young adults between 18 and 34. This overconfidence creates a false sense of security – which in itself is a risk.

The same study also showed that deepfake videos are significantly harder to detect than fake images. Participants were 36% less accurate when determining which videos were AI-manipulated. And considering that all it takes to create a convincing fake video is a photo and a short audio clip, we are facing a real and growing threat.

What are deepfakes, really?

Deepfakes are highly realistic videos, images, or audio recordings that have been manipulated using AI. The technology can swap faces, alter facial expressions, generate entirely fake faces, and make a person appear to say something they never actually said. It can be used for all sorts of purposes.

Deepfakes used in cyberattacks are essentially nothing more than traditional social manipulation – social engineering – in a new form. The goal is to trigger us into acting outside our normal behaviour. It often relies on fear and urgency (such as “Your account will be closed!”), leading to quick clicks or other hasty actions. This is often combined with authority, where the sender pretends to be a manager or a government agency – making our instinctive reaction to comply. Deepfakes of authority figures can be especially effective, as they add significant weight to the request. We are also less accustomed to being sceptical of voice or video compared to, for example, suspicious links in emails or text messages.

How do we protect ourselves against deepfakes?

So how do we build resilience against social manipulation? Instead of trying to become experts at spotting fake videos, there are three more important things to focus on:

• What do our internal and external communication routines look like – and how do we ensure everyone knows and follows them?
  Which channels are used for what type of information? Does a manager usually communicate in this way, through this channel? These are the kinds of questions employees need to be trained to ask.  
• Make sure organisational processes are followed in everyday work.
  All organisations have guidelines and processes that strengthen security – such as requiring at least two people to approve an invoice. But only if they are followed. Security is not something you have on paper; it’s something you do in practice.  
• How do we create a culture based on STAR thinking?
  All Junglemap courses on information security awareness remind end users to always apply a STAR mindset: Stop, Think, Ask someone else, and React to anything that seems unusual.  

This is how we resist social manipulation – whether it is AI-generated or not. Deepfakes are a growing problem and increasingly difficult to detect. In the near future, it may even become completely impossible. Let’s take a step back and make security awareness part of everyday life, uphold our processes – and never stop reminding each other to stop and think, especially when the pressure is high and something feels very urgent.

‍