What is a deepfake, and how worried should I actually be in 2026?
Quick answer
A deepfake is a video, image, or voice recording generated or altered by AI to make a real person appear to say or do something they did not — and in 2026 the realistic threat to ordinary people is not political fake-videos, but voice clones used in phone scams targeting families and finance teams.
What it's NOT
A deepfake is NOT something only state actors and celebrities have to worry about — voice clones can now be made from 3-10 seconds of recorded audio, which means any public voicemail greeting, podcast clip, or Instagram story is enough. And it is NOT always perfect — most real-world deepfakes still have small giveaways (background artefacts, lip-sync mismatches, eye blinking) if you slow down to look.
More context
A deepfake is media — usually video, increasingly voice or image — that has been generated or altered by AI to make a real person appear to do or say something they did not. The name combines deep learning (the AI technique) with fake; it was coined in 2017 around an early class of face-swap algorithms. In 2026 the underlying technology is dramatically better, dramatically cheaper, and available through free or low-cost consumer services.
The realistic threat shape for ordinary people in 2026 — what is actually happening, in order:
- Voice-clone phone scams. A criminal clones the voice of someone you love (child, grandchild, partner) from 5-30 seconds of public audio, then calls you sounding exactly like them. The call is short and urgent: an accident, an arrest, a hostage situation, a sudden bank-account problem. The goal is a fast wire transfer or a delivery of cash to an address. This is the dominant deepfake threat to households globally and is growing fast — France’s CNIL, the FBI, the UK’s Action Fraud have all issued advisories.
- Executive-impersonation video calls. A finance employee receives a video call from “the CFO” (and sometimes other “senior colleagues” too) requesting an urgent transfer. The Arup case in Hong Kong (early 2024) lost $25M this way. Similar attempts on European companies are public; the unreported ones are presumably larger.
- Romance and investment scams reinforced with video. A scammer pretending to be a real-looking person on a dating app uses pre-recorded deepfake video clips and AI voice during calls to maintain the illusion long enough to push a fake crypto investment.
- Political and reputational fakes. Politicians, business leaders, public figures being made to appear to say things they did not. These are the most-discussed deepfakes but, for most ordinary people, the least likely to affect daily life.
- Non-consensual intimate imagery. A serious and growing harm, especially to women and teenage girls. Increasingly criminalised explicitly (France’s SREN law 2024, EU AI Act, UK Online Safety Act, US federal TAKE IT DOWN Act 2025).
The practical defences are about process, not image-spotting:
- A family code word. Agree a single word with your closest people that you can ask for during any “I’m in trouble” call. A voice clone cannot guess it.
- The known callback. For any urgent money request, hang up and call back on the number you already have for that person or institution. Don’t dial the number the call came from.
- Two-channel confirmation at work. No transfer over a certain amount is authorised by video or voice alone — you also confirm in chat with the person, or in person, or with a second signatory.
- Slow down. Every successful deepfake scam relies on you acting in seconds. The 90 seconds it takes you to call back is the entire defence.
- For video calls: ask the other person to do something current generative video struggles with — turn fully sideways, cover one eye with their hand, hold up an object the scammer would not have. It is not perfect, but it raises the cost of the attack.
What is being built (slowly): content provenance standards like C2PA / Content Credentials, where legitimate cameras and editing software sign content cryptographically so that consumers can verify “this video really did come from a Canon camera and was edited only in Adobe Premiere”. Major platforms (TikTok, LinkedIn, Adobe, OpenAI) have begun supporting it; broad consumer-side adoption is still emerging.
Deepfakes are not the end of trust online. The discipline they push us toward — verify through a known second channel, never act on voice or video alone, agree code words — is the same discipline that has always defended against impersonation. It is just no longer optional.
People also ask
Can someone really clone my voice from a short clip? +
Yes. Commercial voice-cloning services need a handful of seconds of clean audio to produce a convincing clone for short utterances. Anyone with a public voicemail message, an Instagram story with their voice, a podcast appearance, or a TikTok with sound has provided enough material. The clone will not pass a long open-ended conversation with someone who knows the person well, but it is more than enough for a 30-second 'I'm in trouble, can you send me money' phone call.
What's the most common deepfake scam in 2026? +
The 'parent in distress' call. The scammer calls a parent or grandparent, plays a cloned voice of their child / grandchild saying 'I've been in an accident' or 'I've been arrested, please don't tell mum, send money to this account'. Sometimes the call is partially live (the scammer speaks normally), sometimes the cloned audio is the whole call. The defence is the same as for all [scam calls](/en/library/everyday/scam-calls/): hang up, call the real person on their known number, agree a family code word in advance.
Are there business deepfake attacks too? +
Yes — and the financial ones are large. The most-cited public case is the Arup engineering firm in Hong Kong (early 2024), where a finance employee was tricked into transferring $25M after a video call where everyone on the screen was a deepfake of senior colleagues. Similar (smaller) attacks have hit companies in Germany, the UK, and France. The defence: never authorise a transfer from a video call alone — always confirm with a second known channel.
How can I tell a deepfake video from a real one? +
In 2026, you often cannot, by eye alone, in a short clip. The reliable tells are about context, not the image: was the video published by a credible source, does it appear on the person's own verified channels, does it match what they have said elsewhere, are independent journalists reporting on it? For video calls specifically, asking the other person to turn their head sideways, cover part of their face with their hand, or stand up — actions current generative video struggles with — sometimes breaks the illusion. The longer-term answer is content provenance standards (C2PA / 'Content Credentials') being added to legitimate cameras and editing tools.
Is non-consensual deepfake porn a crime? +
Yes, in most jurisdictions, and increasingly explicitly so. France criminalised it in 2024 (the SREN law); the EU's AI Act labels non-consensual deepfakes as transparency-mandated; the UK Online Safety Act covers it; many US states have specific laws; the federal 'TAKE IT DOWN Act' was signed into law in 2025. If you or someone you know is a victim, reporting to platforms (which now have legal obligations to act fast) and to law enforcement is the right path, not silence.
Also explained
How do I tell a scam call or text from a real one?
If a call or message creates urgency, asks for a code or password, requests a transfer or gift cards, or threatens you with arrest, fines or account closure, treat it as a scam regardless of who it claims to be — and call the real institution back on a number you find yourself, never on the number the caller gave you.
What is phishing, and how do I recognise it?
Phishing is when someone sends you a fake message — usually email, SMS or chat — that looks like it comes from your bank, your boss, a delivery service or a friend, hoping you click a link, enter a password or transfer money before you notice the small details that give it away.
What is two-factor authentication (2FA), and which kind should I use?
Two-factor authentication adds a second step after your password — a code from an app, a tap on your phone, or a passkey — so that a stolen password alone is no longer enough to log in; in 2026 the best option for most people is a passkey, then an authenticator app, then SMS only as a last resort.