What is a deepfake?
A deepfake is synthetic or manipulated media, usually audio or video, created with machine learning so that it convincingly imitates a real person. The term combines deep learning and fake. In security, deepfakes matter because they make impersonation far harder to doubt. Voice cloning tools can build a usable clone from a short sample of speech, and executives supply plenty of samples through earnings calls, conference talks, podcasts and social media. Real-time tools can map one face onto another during a live video call.
How attackers use deepfakes
- Payment fraud: a cloned executive voice on a call, or a faked video meeting, instructs finance staff to send an urgent, confidential transfer.
- Help desk attacks: a cloned voice of an employee asks for a password or MFA reset.
- Hiring fraud: a fake identity or altered video in a remote job interview gets an attacker hired into a role with system access. The FBI has warned about this pattern since 2022.
- Biometric spoofing: synthetic faces or voices try to pass face or voice authentication.
- Disinformation: fabricated statements damage a person's or company's reputation.
Real deepfake cases
In 2019, the chief executive of a UK energy company transferred about 220,000 euros after a call from someone who sounded like the head of its German parent company. In early 2024, a finance employee at the Hong Kong office of the engineering firm Arup joined a video call with what appeared to be the company's CFO and several colleagues, then made transfers totaling about HK$200 million, roughly US$25 million. The other participants on the call were deepfakes.
How to detect and defend against deepfakes
Technical artifacts exist, such as lip movements out of step with speech, unnatural blinking, blurred edges around the face, lighting that does not match the room and glitches when the person turns or passes a hand in front of the face. They get harder to spot as tools improve, so contextual signs are more dependable: an unusual request, a demand for secrecy or speed, contact through a personal account and resistance to being called back.
The controls that work do not depend on how real the voice or face seemed:
- Verify any payment, credential or access request through a separately initiated contact to a known number.
- Require dual approval for transfers above a threshold.
- Agree challenge phrases or code words in advance between executives and finance teams.
- Require liveness detection and a second factor on any system that authenticates by voice or face.
Deepfake vs. impersonation vs. vishing
Impersonation is posing as a specific person or trusted role, by any means. A deepfake is the synthetic media that makes impersonation convincing, so when a scenario mentions a cloned voice or a fabricated video, deepfake is the more specific answer. Vishing names the phone channel. A call using a cloned CEO voice is both, so answer what the question asks: how the attacker reached the victim (vishing) or what made the call convincing (deepfake).
Deepfake on the CompTIA Security+ exam
Deepfakes appear under SY0-801 objective 2.5 as a social engineering technique, closely tied to the impersonation and biometric threat vectors in objective 2.3. Scenario wording that points to one mentions a voice or video that convincingly imitated a specific real person, often a senior executive, who was never actually on the call. Distractors include impersonation, vishing, whaling and business email compromise. For prevention, the best answer is usually callback verification to a known number plus a second approver, not training staff to spot visual glitches.