What Are Deepfakes — and How Do They Actually Work?

A "deepfake" is AI-generated synthetic media — typically video, images or audio that convincingly appear to show real people doing or saying things they never actually did. The technology moved from research curiosity to everyday reality in under a decade. Today, consumer software can produce passable face swaps, and a short recording of someone's voice can be enough to imitate it. The implications for politics, fraud, harassment and trust in evidence are serious.

This article explains how deepfakes actually work at the level of the underlying models, what they can and cannot do, what real cases look like, how detection and provenance systems try to keep up, and what the law now says.

Key takeaways

• Deepfakes are AI-generated or AI-altered media: face swaps, voice clones, lip-sync edits, and fully synthetic people.
• The core technology is deep neural networks — first paired autoencoders, then generative adversarial networks (GANs), and now diffusion models.
• Quality has improved to the point where casual viewers often cannot tell; even trained detectors struggle on content unlike their training data.
• Documented harms include non-consensual intimate imagery, corporate fraud (one 2024 case cost a firm about US$25 million), and election interference.
• The defence is shifting from "spot the glitch" toward provenance (signed content credentials such as C2PA), verification habits, and legal duties to label or remove content.

What "deepfake" means

The term combines "deep learning" and "fake." It came from the screen name of a Reddit user who began posting face-swapped pornographic videos of celebrities in late 2017; Motherboard's reporting in December 2017 brought the practice to wide attention. The word quickly broadened to cover any convincing AI-made impersonation.

The EU's AI Act now gives it a legal definition: AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places or events and would falsely appear authentic to a person. That definition is useful because it focuses on the effect — misleading resemblance to reality — rather than on any particular algorithm.

In practice, the term covers four families of manipulation:

Face swaps

Replacing one person's face with another's in video, while preserving the original performer's expressions, head movements and lighting.

Voice clones

Synthesising someone's voice from a sample so a system can make that voice say new words.

Lip-sync and expression manipulation

Keeping real footage of a person but changing the mouth movements to match different audio, or subtly altering facial expression.

Fully synthetic people

Generating images or video of people who do not exist. These are not impersonations of a specific person, but they are used for fake profiles, fake reviewers and fake "experts."

All four rely on the same broad idea: train a neural network on large amounts of real data until it learns the statistical structure of faces or voices well enough to produce new examples. If you want the foundations, our explainer on how neural networks work covers layers, weights and training.

A short history, with dates

Year	Milestone	Why it mattered
1997	"Video Rewrite" research (Bregler, Covell, Slaney) automated lip-sync to new audio	Showed footage could be re-animated by software
2014	Goodfellow et al. publish Generative Adversarial Networks (arXiv, June 2014)	Provided the training method behind photoreal synthetic faces
2017	Reddit user "deepfakes" posts face-swap videos; term coined	Face swapping moved from labs to hobbyists
2018	FakeApp released (January 2018)	Point-and-click face swaps for non-programmers
2019	FaceForensics++ benchmark (Rössler et al.) released	First large standard dataset for training and testing detectors
2019	Deeptrace counts 14,678 deepfake videos online, 96% non-consensual pornography	First widely cited measurement of the problem
2021	C2PA standards body formed from Adobe's Content Authenticity Initiative and Project Origin	Industry shift toward signed provenance
2024	Biden voice-clone robocall in New Hampshire; Arup US$25 million video-call fraud	Election and corporate harms became concrete
2025	US TAKE IT DOWN Act signed (19 May 2025)	First US federal law aimed at intimate deepfakes
2026	EU AI Act Article 50 transparency duties scheduled to apply (2 August 2026; the machine-readable marking duty for already-marketed systems was moved to 2 December 2026 under the AI Omnibus deal)	Mandatory deepfake disclosure across the EU

The trend is consistent: each step lowered the skill, data and money needed to make a convincing fake.

How face-swap deepfakes work

The classic deepfake approach — the one used by the original Reddit code and early open-source tools — relies on autoencoders, neural networks that learn to compress an image into a small code and then reconstruct it.

Step 1: Collect and align faces

The software extracts thousands of face crops from video of person A (the source face) and person B (the target, whose body and scene you keep). A face detector finds each face, and a landmark model locates eyes, nose and mouth so every crop can be rotated and scaled to a standard pose. Alignment matters: the network learns far faster when every eye sits in roughly the same pixel position.

Step 2: Train a shared encoder and two decoders

Two autoencoders are trained at the same time. They share one encoder, which turns a face into a compact representation, but each has its own decoder, which turns that representation back into a face. Decoder A learns to paint person A's face; decoder B learns to paint person B's. Because the encoder is shared, it is pushed to capture things common to both — head angle, expression, gaze, lighting — rather than identity.

Step 3: Swap

Take a frame of person B. Encode it with the shared encoder, which captures B's pose and expression. Then decode it with decoder A. The output is person A's face wearing person B's expression under person B's lighting.

Step 4: Blend and repeat

The generated face is pasted back into the original frame using a mask, colour-corrected to match skin tone, and blended at the edges. This is repeated for every frame. Early artifacts — flickering, mismatched skin tone, a visible "seam" around the jaw — came mostly from this step.

Why newer methods look better

GANs add a second network, the discriminator, that tries to tell real images from generated ones while the generator tries to fool it. That adversarial pressure pushes the generator toward sharper, more realistic texture. Diffusion models, which now dominate image and video generation, learn to reverse a gradual noising process: starting from random noise, they remove noise step by step until an image appears. Our explainer on how diffusion models generate images walks through that process. Diffusion-based tools can do "identity-preserving" generation: give them a few photos of a person and a text prompt, and they produce new images of that person in scenes that never existed.

Technique	Core idea	Typical strengths	Typical weaknesses
Paired autoencoders	Shared encoder, per-person decoders	Simple, works on consumer GPUs	Needs lots of footage of both people; blending seams
GANs	Generator vs. discriminator training	Very sharp faces (e.g. StyleGAN)	Training instability; struggles with full scenes
Diffusion models	Learn to remove noise step by step	High diversity, text control, few reference photos	Slow; hands, text and fine consistency can fail
Neural rendering / reenactment	Drive a face model with another person's motion	Good lip-sync and expression control	Limited head turns; can look "pasted on"

How voice cloning works

Modern text-to-speech systems usually have three parts:

1. A speaker encoder listens to a sample of the target voice and compresses its characteristics — pitch range, timbre, accent, speaking rate — into a numeric "voice fingerprint."
2. An acoustic model takes text plus that fingerprint and predicts what the speech should look like as a spectrogram (a picture of sound frequencies over time).
3. A vocoder turns the spectrogram into an audio waveform.

Because the speaker encoder is trained on thousands of different voices, it learns a general "space" of voices. A new speaker only needs to be located in that space, which is why short samples can be enough for a recognisable imitation. Quality still improves with more and cleaner audio, and emotional range, laughter and unusual accents remain harder.

Legitimate uses are real: restoring speech for people who lose their voice to illness, dubbing, accessibility tools and audiobook narration. Commercial services, compared in our guide to AI voice tools, typically require consent checks before cloning. The same underlying capability is what fraudsters use.

How fully generated faces work

"This Person Does Not Exist," a website launched in 2019, showed a new GAN-generated face on every refresh and made the public aware of how realistic synthetic faces had become. Today's image generators — the same families described in our overview of generative AI — can produce faces of arbitrary age, ethnicity and expression in any setting.

Synthetic faces are often used not to impersonate anyone but to create believable fake accounts. A profile photo that cannot be reverse-image-searched — because it was never photographed — makes a sock-puppet account look more legitimate.

What modern deepfakes can and cannot do

Strengths

• Short clips at moderate resolution can fool casual viewers, especially on a phone screen.
• Real-time face swaps during video calls exist, though usually at lower quality than offline renders.
• Voice imitation from limited audio is convincing enough for short phone calls, particularly when the listener is under time pressure.
• Subtle edits — changing a few words, adjusting an expression — are harder to notice than full fabrications.

Weaknesses (shrinking every year)

• Long-form video: small inconsistencies accumulate over minutes.
• Extreme angles and occlusion: profile views, hands crossing the face, or glasses can produce artifacts, because training data is mostly frontal.
• Hair, teeth and jewellery: fine, high-frequency detail is hard to render consistently frame to frame.
• Targets with little public footage are harder to fake than celebrities with thousands of hours of video.
• Interaction: a live fake can falter if asked to turn sideways, wave a hand in front of the face, or answer a question only the real person would know.

Real cases, and what they teach

Corporate fraud: the Arup video call (2024)

In February 2024 Hong Kong police described a case in which a finance employee at a multinational joined a video call with what appeared to be the company's chief financial officer and several colleagues. Every other participant was a deepfake. Following instructions on the call, the employee made 15 transfers totalling HK$200 million — about US$25.6 million — to five local bank accounts. In May 2024 the British engineering firm Arup confirmed it was the victim and said its internal systems had not been compromised. The lesson: the employee had initially suspected a phishing email; seeing familiar faces is what overcame his doubt. Video presence is no longer proof of identity.

Election interference: the New Hampshire robocall (2024)

Before the January 2024 New Hampshire presidential primary, voters received robocalls using an AI-generated imitation of President Biden's voice discouraging them from voting. The US Federal Communications Commission finalised a US$6 million fine against the political consultant who commissioned the calls in September 2024, and he was also criminally charged in New Hampshire, though a jury acquitted him on all charges in June 2025. The calls were cheap to make, which is exactly why they worry election officials.

Non-consensual intimate imagery

By volume, sexual imagery remains the dominant harm. Deeptrace's 2019 report counted 14,678 deepfake videos online and found 96% were non-consensual pornography, overwhelmingly targeting women. That figure is now old and the absolute numbers have grown, but researchers consistently find that intimate imagery dominates. Victims include public figures, but increasingly also private individuals, including school students.

The "liar's dividend"

A subtler harm is that the existence of deepfakes lets people dismiss real recordings as fake. Legal scholars Bobby Chesney and Danielle Citron named this the "liar's dividend" in 2019. Every convincing fake makes authentic evidence slightly easier to deny. This links to well-studied features of human memory and belief; the Loftus misinformation experiments showed that people's recollection of events can be reshaped by suggestive information afterward, and synthetic media is a powerful form of suggestion.

Why scams work even with imperfect fakes

A deepfake does not need to be flawless; it needs to be good enough for the situation. Fraud scripts typically combine the fake with classic pressure tactics: urgency ("the deal closes in an hour"), authority ("this is the CFO"), secrecy ("don't discuss this with anyone yet") and an unusual payment route. Our piece on scam psychology explains why these levers work on intelligent people. Grainy video or a slightly robotic voice is easily excused as "bad connection." In practice, the strongest defence is a process — call-back verification on a known number, two-person approval for payments — not a sharper eye.

How to spot a deepfake (and why it is getting harder)

Visual and audio cues still sometimes help:

• Lighting and shadows on the face that do not match the scene.
• Eyes and teeth: unnatural blinking, mismatched reflections in the two eyes, teeth that blur into a single block.
• Edges: irregular hair boundaries, earrings that change shape, a face that "slides" against the head during fast motion.
• Audio: flat emotional tone, odd breathing patterns, mispronounced names, or audio that is suspiciously clean for the setting.
• Context: does the source make sense? Is this claim being reported by anyone else? Is the request unusual?

But be honest about the limits. Cue lists go out of date quickly, because each widely publicised tell becomes a target for the next generation of tools. The FaceForensics++ researchers found that their trained detectors clearly outperformed human observers, and human accuracy drops further on compressed social-media video. Treat a lack of visible glitches as no evidence at all.

Detection technology

Forensic analysis

Examines pixel statistics, compression traces, inconsistencies between the face region and the rest of the frame, and physiological signals such as subtle skin-colour changes from blood flow.

AI detectors

Neural networks trained on labelled real and fake media. Benchmarks like FaceForensics++ — built from over 1.8 million manipulated images across four manipulation methods (DeepFakes, Face2Face, FaceSwap and NeuralTextures) — made systematic training possible. The persistent problem is generalisation: a detector trained on one family of fakes often performs much worse on fakes made by a new method it has never seen. It is an arms race, and detector scores should be treated as one signal among several, not a verdict.

Watermarking

Some generators embed invisible watermarks in their output. This helps when it works, but watermarks can be weakened by cropping, re-encoding or deliberate attack, and open-source tools need not include them. The EU AI Act requires providers of generative systems to mark output in a machine-readable way (with a phased start in 2026), which should make watermarking more common in Europe.

Provenance and content credentials

Rather than proving something is fake, provenance systems prove where authentic content came from. The Coalition for Content Provenance and Authenticity (C2PA) — which combined the efforts of Adobe's Content Authenticity Initiative and Project Origin — publishes an open technical standard for attaching cryptographically signed "content credentials" to a file. A credential can record which camera or app created an image and what edits were made. Some cameras, editing tools and platforms now read or write these credentials.

Provenance has its own limits: credentials can be stripped by screenshotting, most content in circulation still carries none, and a missing credential does not mean a file is fake. But it flips the question from "can we prove this is fake?" to "can the publisher prove this is real?", which scales better.

Defence	What it proves	Main limitation
Human inspection	Nothing reliable	Fooled by good fakes and compression
AI detectors	Probability of manipulation	Poor generalisation to new methods
Watermarks	Content came from a cooperating generator	Removable; absent from many tools
C2PA content credentials	Origin and edit history of authentic files	Easily stripped; adoption incomplete
Process controls (call-backs, dual approval)	The request is genuine	Requires discipline and planning

Legal and policy responses

Laws are catching up, unevenly.

United States

The TAKE IT DOWN Act, signed on 19 May 2025, makes it a federal crime to knowingly publish non-consensual intimate images of identifiable people, explicitly including AI-made "digital forgeries," and to threaten to do so. Penalties reach up to two years in prison for depictions of adults and three years for minors. Covered platforms had until 19 May 2026 to set up a notice-and-removal process; once they receive a valid request they must remove the content within 48 hours and make reasonable efforts to remove known copies. The Federal Trade Commission enforces the platform duties. Civil-liberties groups have criticised the short removal window as likely to encourage over-removal. Many US states also have their own laws on intimate deepfakes and election deepfakes.

European Union

Article 50 of the EU AI Act requires anyone deploying an AI system to create deepfakes to disclose that the content was artificially generated or manipulated, clearly and at the latest at first exposure. Evidently artistic, satirical or fictional works get a lighter duty: they must flag the existence of manipulated content without spoiling the work. Providers of generative systems must also mark outputs in a machine-readable format. These obligations are scheduled to apply from 2 August 2026. A 2026 "AI Omnibus" amendment, agreed politically in May 2026 and reported as adopted by the Council in June, gives providers of generative systems already on the market until 2 December 2026 to meet the machine-readable marking duty; check the Official Journal text for the final dates.

Elsewhere

The UK's Online Safety Act 2023 created offences around sharing intimate images, including deepfakes, and a further offence of creating them came into force in February 2026. China has required labelling of AI-generated content since September 2025, and South Korea's legislature voted in September 2024 to criminalise possessing or watching sexually explicit deepfakes. International coordination remains limited, and enforcement against anonymous overseas creators is difficult. Cybercrime is already global — see our ranking of countries with the most cybercrime activity — and deepfake fraud follows the same patterns.

Legitimate uses

Synthetic media is not inherently harmful. Film studios use face replacement and de-ageing; dubbing tools can match lip movements to translated audio; people with motor neurone disease have used voice banking to keep speaking in their own voice; museums and educators create interactive historical figures with clear labelling. The ethical line, discussed more broadly in our article on AI ethics debates, is consent and disclosure: who agreed to their likeness being used, and does the audience know?

Common misconceptions

"I would always be able to tell." Studies of human detection consistently find people overestimate their accuracy, and confidence is a poor guide.

"Detectors will solve this." Detectors help platforms triage, but generalisation to new methods is the core unsolved problem.

"Only celebrities are targets." Private individuals are increasingly targeted, especially for harassment and intimate imagery, and voice-clone scams target ordinary families.

"Deepfakes are mainly a political problem." Political deepfakes get headlines, but measured volume is dominated by sexual imagery and fraud.

What you can do

As a viewer

• Be most sceptical of emotionally charged content from unknown sources.
• Look for the original source and for independent reporting before sharing.
• Check for content credentials where tools support them.

As an organisation

• Require call-back verification on a known number for any payment or credential request, regardless of who appears to be asking.
• Use two-person approval for large or unusual transfers.
• Agree code words or out-of-band checks for executives.
• Train staff with real case studies like Arup's.

As a family

• Agree a family "safe word" for emergencies, so a panicked call claiming to be a relative can be checked.
• Hang up and call back on a number you already know.

As a target

• Document everything (screenshots, URLs, dates).
• Report to the platform; in the US, intimate deepfakes now trigger a legal 48-hour removal duty on covered platforms.
• Seek legal advice or support from victim organisations where available.

What's coming next

• Video generation systems will keep improving in length and consistency, making long clips easier to fake.
• Real-time interaction will get better, putting more pressure on video-call identity checks.
• Provenance by default: more cameras, phones and platforms will sign and display content credentials.
• Regulatory enforcement will begin in earnest as EU transparency duties and US takedown duties take effect.
• Identity verification for high-stakes actions will move away from "seeing someone's face" toward cryptographic and procedural checks.

There are also open questions researchers have not settled: whether watermarks can be made robust against determined attackers, how to display provenance so ordinary users actually notice it, and how to balance fast takedown with protection for legitimate speech and satire. For tools that use AI to help readers keep up with the news, see best AI news summary aggregators 2026.

Frequently asked questions

Q: Are deepfakes always illegal? A: No. Creating synthetic media is generally legal, and film, dubbing, accessibility and satire are legitimate uses. Specific uses are illegal in many places, such as non-consensual intimate imagery, fraud, and certain election deception, and the EU now requires disclosure of deepfakes.

Q: How much audio does it take to clone a voice? A: Modern systems can produce a recognisable imitation from short samples because they place a new speaker inside a voice space learned from thousands of others. Quality, emotional range and accuracy improve with more and cleaner audio.

Q: Can AI detectors reliably identify deepfakes? A: Not reliably on their own. Detectors trained on benchmarks such as FaceForensics++ beat human observers on familiar methods, but often perform much worse on fakes made with new techniques. Treat a detector score as one signal among several.

Q: What is C2PA? A: The Coalition for Content Provenance and Authenticity publishes an open standard for attaching signed content credentials to files, recording where they came from and how they were edited. It helps prove authentic content is real rather than proving fakes are fake.

Q: What does the TAKE IT DOWN Act require? A: Signed on 19 May 2025, it criminalises knowingly publishing non-consensual intimate images, including AI-generated ones, and requires covered platforms to remove such content within 48 hours of a valid request. The FTC enforces the platform duties.

Q: How do I protect my company from deepfake payment fraud? A: Rely on process rather than perception: verify payment requests by calling back on a known number, require two-person approval for unusual transfers, and train staff on cases such as the 2024 Arup video-call fraud.

Q: Will all video become untrustworthy? A: Not all of it, but a single clip is weaker evidence than it used to be. Trust will increasingly rest on provenance, multiple independent sources and the reputation of the publisher.

The bottom line

Deepfakes are a direct product of the same deep-learning advances that power image generators and voice assistants: networks that learn the structure of faces and voices well enough to produce new ones. Their legitimate uses are real, but the measured harms — intimate imagery, fraud and election deception — are serious and growing. Spotting glitches by eye is a losing strategy. The durable defences are provenance standards, verification processes, platform duties and clear laws, combined with the habit of checking where a piece of media came from before believing or sharing it.

Related Reading

• What Are AI Agents — and How Do They Actually Work?
• What Is Neuralink? How Brain-Computer Interfaces Actually Work

Sources

• Goodfellow, I. et al. (2014). Generative Adversarial Networks. arXiv:1406.2661.
• Rössler, A. et al. (2019). FaceForensics++: Learning to Detect Manipulated Facial Images. arXiv:1901.08971.
• EU AI Act, Article 50: Transparency obligations.
• Congressional Research Service (2025). The TAKE IT DOWN Act: A Federal Law Prohibiting the Nonconsensual Publication of Intimate Images.
• C2PA — About.
• CNN via ABC17 (2024). British engineering giant Arup revealed as $25 million deepfake scam victim.
• WBUR (2024). Steve Kramer Biden robocalls fines.
• Deeptrace (2019). The State of Deepfakes: Landscape, Threats, and Impact.