A face you recognise

For most of the past ten years the fragile part of these operations was the person on the other end: an accent that did not fit the company, a script that came apart under an unscripted question, a video call forever declined. That fragility is disappearing. Across files opened in the last two years, cloned voice and manufactured video have gone from curiosity to standard equipment.

Where you meet it

The first is the advertisement. A national broadcaster's studio, a familiar presenter, a finance minister or a well-known founder recommending a platform in fluent, unaccented speech in whichever language you happen to read in. None of it happened. The footage is real, the words are not, and the clip is convincing enough that people report having watched it several times before registering.

Second comes the call. Once there is an account, the "adviser" rings — and where the operation has recordings to build on, that voice can be modelled on somebody real, including a person the client has genuinely spoken to at a legitimate firm.

Third is the verification itself. Ask to see who you are dealing with and a short video call is now offered rather than dodged. A face appears, moves and answers questions. Willingness to go on camera used to settle the matter. It settles nothing now.

Why careful people are not immune

Because it goes after the checks people genuinely run. Most verification is recognition rather than record: does the face look right, does the voice sound like him, was a video call agreed to. Synthetic media passes all three convincingly and touches none of the questions that still work — the company number, the register entry, the name on the receiving account.

There is a second effect, visible in first conversations. Clients taken in by a convincing video are markedly more reluctant to describe it, because being fooled by a face feels like a private failure of judgment. It is not one. It is the failure of a verification method that stopped working faster than anybody was told.

The things that still cannot be faked

The paperwork. However convincing the call was, the money arrived somewhere with a name attached, and that half of it is as documentary as it ever was:

• The receiving account or wallet, which belongs to an institution or service that exists
• The company details on the site, which either turn up on a public register or do not
• The route the payment took, through providers that keep records of it
• The messages themselves, which exist whether or not the voice in them belonged to anyone

Which is why a case that began with a deepfake is no weaker than any other. The synthetic layer lies over an entirely ordinary payment trail, and the trail is what the work is done on.

The one check that still holds

One habit beats any attempt at spotting a flaw in a video: check through a channel the other side did not pick. Find the firm on the regulator's own register and ring the number printed there, not the number you were handed. If the person is real, that costs five minutes. If not, it ends the conversation on the spot.

This method will keep spreading, and we would rather say so plainly than tell people to trust their instinct about whether a face is real. That instinct has stopped being reliable, and pretending otherwise serves nobody.