Max AlexanderD.Eng., CEng MIET
← Max Alexander

Detecting AI and deepfake fraud

Point of view

For most of the history of fraud, catching a forgery meant finding the seam — a voice that didn’t quite breathe, a signature that shook, a document whose fonts didn’t line up. Two things have changed at once. The fakes have gotten good enough that the seam is often gone, and the tools to make them have gotten cheap enough that anyone can. What follows is how I think about detection on both fronts: reading the image, and defending the transaction.

Reading the image: a working field guide

For a still image, a trained eye still catches a great deal. The most useful taxonomy I teach comes from a 2024 Northwestern / Kellogg guide, How to Distinguish AI-Generated Images from Authentic Photographs (Kamali, Nakamura, Chatzimparmpas, Hullman & Groh). It sorts the tells into five families — illustrated here schematically:

Anatomy

An extra or fused finger, teeth that overlap or multiply, eyes whose reflections don’t match, two people who merge where they touch.

Style

Poreless, plastic skin and lighting too perfect for any real room; a uniform hyper-real sharpness; resolution and color that shift within one frame.

Function

Objects that couldn’t work — straps fastened to nothing, machinery that doesn’t connect — and text or logos that melt into gibberish up close.

Physics

Shadows falling the wrong way, reflections that don’t match their source, depth and perspective that never quite resolve.

Sociocultural

Scenes subtly wrong for their setting — an anachronism, the wrong uniform, a gesture or norm a genuine photograph there wouldn’t contain.

Diagrams, not real examples — for actual photographs to test yourself on, see the Detect Fakes project.

The tells have a shelf life

Every one of these is a defect the next model is trained to remove. Artifact-spotting is a fading advantage: strongest today for ordinary images, weakest against a well-funded, targeted fake. It is a genuine literacy skill and a reasonable first look. It is not a control you can build a decision on, because the moment a tell becomes reliable enough to teach, it becomes a target to engineer out.

Automated detectors inherit the same problem. A 2026 review of detection techniques found that even the strongest models lose accuracy the moment they meet a generator they were not trained on — cross-dataset performance falls sharply — which is the arms race restated as a measurement.

When money is on the line

The deepfake is the delivery, not the vulnerability. The now-canonical case — a finance employee on a live video call with a fabricated executive, approving a wire — does not work because the synthetic face is flawless. It works because a single, synchronous, high-pressure interaction was allowed to authorize an irreversible action. Strip out the technology and the shape is ancient: authority, urgency, and a channel the target already trusts.

So durable detection stops asking does this look real? and starts asking can its origin and its authority be confirmed independently? Four things hold up as the generators improve:

Build one more assumption in: that the adversary has already read your mail. Business-email-compromise crews routinely sit inside a mailbox or a chat thread for weeks before they move, learning the names, the deal, the tone — and the very facts you might reach for as proof. A challenge drawn from that shared context (which deal are we closing? who’s on the account?) may be something they already know cold. The secret has to be something never sent in-band — and, better still, used only once.

The shared-secret idea has an extreme form worth picturing — the one-time pad. Instead of a single memorized phrase, both ends hold an identical stack of single-use codes and burn each line after one exchange:

ONE-TIME PAD · USE EACH LINE ONCE 07  48120 93756 22087 08  71904 38625 50413 09  66208 17739 84120 10  30947 62815 09338
Line 07 is spent and struck out; the next request must quote line 08, then line 09, and so on. Because nothing repeats, a replayed recording of an earlier exchange is worthless — and an impersonator who never held the pad has nothing to say.

This is also the frontier a new class of tooling is built for — real-time authentication of voice and video on live calls, the problem Hany Farid’s GetReal Security was founded to solve. Farid helped establish digital forensics as a field two decades ago; that such a company now needs to exist for live conversations is the clearest measure of how far the threat has moved. The detection is worth having. The process controls are what keep you safe the day it misses.

Two cases

Arup, Hong Kong, 2024 — the fraud that worked. A finance employee received an email from the firm’s UK CFO about a confidential transaction. Suspecting a phish, he asked to confirm — and was put on a video call with the CFO and several colleagues he recognized. Every face and voice on that call was a deepfake, assembled from public footage. Reassured, he made fifteen transfers totaling about US$25 million. The firm stressed afterward that no system was breached — social engineering with a better mask.

Ferrari, 2024 — the fraud that failed. An executive received WhatsApp messages and then a call from “CEO Benedetto Vigna,” voice and southern-Italian accent cloned, pressing a secret acquisition and explaining that a different number was being used “for security.” Uneasy about a faint artificial intonation, the executive asked one question: the title of a book Vigna had recommended days earlier. The caller couldn’t answer and hung up. A shared, fresh, out-of-band fact — a parole no clone could hold — ended it in a single move. And note why it worked: the answer lived in a recent conversation, not in an email thread an intruder could have been reading.

The subtler cost: the liar’s dividend

There is a harm beyond being fooled. Once everyone knows convincing fakes are possible, the merely possible becomes a defense — real footage can be waved away as “probably AI.” Bobby Chesney and Danielle Citron named this the liar’s dividend, and empirical work since (in the American Political Science Review, among others) finds that mere exposure to the idea of deepfakes measurably lowers trust in genuine media. For an institution, that is the strategic risk: not one forged video, but the slow loss of any shared basis for believing evidence at all. It is the deception payoff without the deception — the adversary profits from doubt alone.

A denial-and-deception problem, not a computer-vision one

The most useful frame is the oldest. Deepfake fraud is deception — your own evidence turned against you — and deception has never been beaten by studying the artifact alone. It is beaten by refusing to let any single piece of evidence stand on its own, and by asking, before whether a thing looks right, what would have to be true for it to be a lie, and whether that has been checked through a channel the adversary doesn’t hold. Build for that, and it stops mattering how good the fake gets.

Test yourself

Calibration beats theory. Try to separate the real photographs from the generated ones at the Northwestern team’s Detect Fakes project — most people do worse than they expect.

Detection tools and standards

No detector is a verdict — treat every score as evidence, not proof. With that caveat, the landscape worth knowing:

Further reading

← Back