Think you can spot a deepfake? Probably not

EIGHTY per cent of Singaporeans believe they can spot a deepfake video, but only 25 per cent actually can.

That’s the stark finding from a survey by Singapore’s Cyber Security Agency (CSA) released in July, and it should serve as a national wake-up call. In a digital world where manipulated audio and video are now tools of deception, our overestimation of our own ability to spot what’s fake could be our biggest vulnerability.

The deepfake evolution

Once confined to Internet humour and fringe subcultures, deepfakes have evolved into potent tools for cybercriminals.

Consider the 2024 deepfake livestream that leveraged the hype around the US Presidential debates. The stream began by mimicking a real political event – claiming to show a debate between Donald Trump, Elon Musk and Kamala Harris, before transiting to Musk promoting a financial scam. The production was slick, complete with commentary and transitions. Hundreds of thousands of people watched, and many fell for it.

In Asia, scammers went a step further: A malicious website disguised as the Yomiuri Shimbun – Japan’s largest newspaper – featured a fake article, AI-generated testimonials and a deepfake video of Musk endorsing an investment scheme. Everything looked real, but with one click on the “register” button, users were redirected to a fraudulent crypto platform designed to steal their money. 

Deepfakes are no longer entertainment – they are growing financial and reputational threats. 

Seeing is believing, until now

The technology that creates deepfake videos is evolving at a pace that far surpasses public awareness. With freely available AI tools, even amateur scammers with little technical skill can generate audio and video content that looks and sounds remarkably real.

This growing accessibility is what makes deepfakes especially dangerous. Unlike traditional phishing, which might rely on poorly worded e-mails or obvious red flags, deepfakes tap into something more primal: our belief in what our senses tell us. A video of your CEO asking you to authorise a payment. A voice message from your supplier about a change in bank account details. A video report from a “journalist” announcing fake news about your company. All of these are now possible, and they have been used in real-world scams.

So how should organisations respond?

First, challenge overconfidence with training. We need to abandon the notion that deepfake detection is an innate skill. The CSA survey makes clear that overconfidence is the enemy. Cybersecurity training programmes must evolve to reflect today’s threat landscape. This means educating not just IT teams, but also frontline employees, such as those in finance, HR and executive roles, about how deepfakes work and how to respond when something feels off.

Second, organisations must shift from a reactive to a preemptive mindset. Early detection – before the payload is delivered or the scam is executed – is the most effective defence. Using predictive intelligence at the DNS layer – essentially the internet’s address book, which connects a website name to its online location – organisations can identify suspicious domains and infrastructure long before they are used in an attack.

This kind of upstream protection is crucial in an era where attacks can be launched and spread within minutes. For example, many deepfake scams rely on newly registered domains or domains that mimic legitimate sources. By identifying and blocking these domains early, we can prevent users from ever reaching the malicious content in the first place.

Another important step is to deploy AI-powered deepfake detection tools. These systems can analyse subtle inconsistencies in facial movement, voice modulation and video artefacts — patterns that are invisible to the human eye but detectable by machine learning models trained on large datasets.

Equally important is the use of multi-factor authentication (MFA), particularly for sensitive communications or high-value transactions, to reinforce verification. MFA adds a layer of friction that can help stop a deepfake-led social engineering attack in its tracks. If a scammer impersonates a company executive via deepfake video, MFA ensures that the visual is not the only form of identity verification.

Finally, businesses must collaborate. No organisation can tackle this problem alone. Industry alliances, government partnerships and cross-sector threat intelligence sharing will be essential to staying ahead of adversaries who are innovating faster than ever.

Rethinking trust in the age of AI deception

We’re now in an era where trust itself is under attack. The tools we use to build authenticity and credibility, such as video calls, voice messages and visual content, are the very tools being turned against us.

What raises the stakes further is AI’s capacity for recursive self-improvement, which are systems that are capable of advancing their own design and accelerating the next wave of innovation. This does not just mean faster progress, but it is progress on exponential terms. Disruption will arrive sooner and in ways that society at large may not immediately recognise. 

In such a world, vigilance is not enough. As we navigate this new frontier, the most dangerous assumption we can make is that we will “just know” when something is fake. Because if the scammers have their way, you won’t. Now is the time for businesses to build processes that account for our own human limitations.

The writer is regional director, Southeast Asia and Korea, at Infoblox