Deepfake: What It Is, How to Detect Fraud, and How to Preserve Evidence

You see a video of someone you know speaking directly to the camera. You recognize their face, their gestures, and their voice. Everything suggests they are who they claim to be.

Or you take part in a video call with several managers from your company and receive instructions to carry out an urgent transaction. It seems to be coming from your superior.

Until recently, seeing and hearing someone could be enough to trust that they really were that person. But with a deepfake, that certainty disappears.

Artificial intelligence makes it possible to generate or manipulate increasingly convincing images, videos, and audio. These techniques are already being used to impersonate well-known people, celebrities, businesspeople, or family members and make certain scams more believable.

INCIBE (Spanish National Cybersecurity Institute) defines deepfakes as videos manipulated using artificial intelligence to make people believe that someone has made statements or performed actions that never actually took place. You can read more information about deepfakes on the INCIBE website.

This definition focuses on video, but in practice the term covers images, video, and voice. A deepfake can be used to alter a face, create seemingly real photographs, generate fake videos, or even impersonate someone’s appearance during a video call.

Voice cloning, or deepvoice, is one of its variants and is now one of the most commonly used techniques in phone scams, as only a very short audio sample is needed to produce a convincing result.

Let’s look at two of the most common fraudulent uses:

One of the most concerning uses of deepfakes in the business environment is CEO fraud, in which criminals impersonate a senior executive to request transfers, payments, or other sensitive transactions.

In Spain, INCIBE has documented cases of CEO fraud involving artificial intelligence techniques, such as cloning the voice of a senior executive to order an urgent bank transfer.

In one such case, several employees received a call from someone who appeared to be one of the company’s top executives. The voice was almost identical, and the supposed executive asked them to make a transfer for an urgent transaction.

Days later, they discovered that the CEO had never made the call. Read the voice-cloning fraud case published by INCIBE.

Another striking example of these deepfake techniques occurred in Hong Kong.

In 2024, an employee of a multinational company took part in a video conference in which several company executives appeared to be present. According to the Hong Kong authorities, the criminals used publicly available videos and voices to create the meeting using deepfake technology. The employee authorized transfers totaling around HK$200 million (approximately €23 million).

This case shows just how far CEO fraud has evolved. Impersonation is no longer limited to fake emails or messages: artificial intelligence can now imitate a senior executive’s voice, appearance, and even presence in a video call.

Selva Orejón (@selvaorejon), a specialist in digital identity and cybersecurity, has warned about precisely this type of real-time deepfake, as well as the use of photographs, manipulated videos, and synthetic identities to commit fraud. Read the Cadena SER interview with Selva Orejón about AI-powered identity impersonation.

But deepfakes are not only used within companies. They can also exploit the image of public figures or celebrities to build trust and make fraudulent investments, products, or services appear more credible.

In August 2025, RTVE warned about an AI-manipulated video in which Banco Santander chair Ana Botín and journalist Marc Sala appeared to be featured.

In reality, it was a deepfake used to promote a fraudulent investment platform. The video manipulated the image and voice of the people appearing in it to make viewers believe that they endorsed the investment. Here you can read the fact-check published by VerificaRTVE.

This is not an isolated case. Spain’s National Securities Market Commission (CNMV) has warned about this type of video, in which public figures are impersonated to promote fraudulent investments, and recommends not providing personal information or money through them.

It is worth keeping in mind something that is often overlooked: many of these campaigns do not consist of just one video. They are supported by websites that copy the corporate image of a news outlet or financial institution to make a fabricated story appear credible. That is why, when preserving evidence, the video is often only one part of what may need to be documented.

Seeing someone appear in a video promoting an investment no longer necessarily means that they actually took part in the recording.

This type of fraud exploits the visibility and credibility of a well-known person to persuade the victim to trust an offer, investment, or service that the person has not actually endorsed.

As of 2 August 2026, Article 50 of the European Union Artificial Intelligence Act (AI Act) applies, establishing transparency obligations for certain AI-generated or manipulated content.

Specifically, Article 50(4) requires anyone using an AI system to generate or manipulate images, audio, or video that constitute a deepfake to disclose that the content has been artificially generated or manipulated.

In practice, this means that, where this obligation applies, a deepfake must be identified as AI-generated or manipulated content. This will not prevent fraudulent deepfakes from existing, but it makes it particularly important to preserve how the content was published, where it appeared, and whether or not it was identified as AI-generated.

Visual clues are becoming increasingly unreliable. Two years ago, noticing unnatural blinking might have been enough, but today many deepfakes can easily pass that test.

The signs below can help you identify a possible deepfake, but the decision should never be based solely on whether a video “looks strange.”

If you receive a financial request or one involving particularly sensitive information:

And if you detect a possible deepfake, impersonation, or attempted fraud:

⚠️ Preserve the evidence before reporting or blocking it.

Once a profile, video, or post has been reported, the platform may remove it or the author may modify it.

That is why you should not preserve only the video or image.

It may also be important to preserve:

The context can be just as important as the deepfake itself.

In our article How to Certify Social Media Posts Step by Step, we explain how to preserve a post together with its profile and context.

It is important to note that SaveTheProof does not determine whether an image or video is a deepfake.

Determining technically whether content has been generated or manipulated using artificial intelligence may require analysis by a specialized digital forensic expert.

SaveTheProof allows you to certify digital evidence related to fraud or impersonation before it can be modified or disappear.

➡️ If the Deepfake Is Published Online

With a Web Browsing Session Certificate, you can access the profile, display the post, play the video, take screenshots, browse related content, and download files.

If you have emails related to the fraud and the email account can be accessed via webmail over the Internet, you can also access and certify them during the session.

The entire browsing session is recorded on video, including any audio played during the session.

This allows you to preserve not only an isolated screenshot, but also how the content appeared, where it was published, and its context.

➡️ If You Only Have the Video or Audio File

If the content is no longer available online, but you have the related image, video, audio, or document, SaveTheProof cannot certify its origin. However, you can use the File Certificate to provide evidence that the file was in the possession of the person who certified it at the time of certification.

Among other data, the certificate includes the SHA-256 hash of the file, allowing its integrity to be verified later and confirming that it has not been modified.

Certification with SaveTheProof allows you to preserve the evidence. Determining whether content may have been manipulated using artificial intelligence may require expert forensic analysis.

A video may have been generated using artificial intelligence.

And the people appearing in a video call may not be who they seem to be.

That is why, if you detect a possible deepfake, in addition to verifying the situation through other channels, it is important to preserve the digital evidence before it can disappear.

SaveTheProof allows you to certify web pages, browsing sessions, and files through certificates with advanced electronic signatures and qualified electronic timestamps in accordance with the eIDAS Regulation.

Do not rely on the content remaining online. Certify the evidence before it changes or disappears.

Do you have any questions? Write to us at [email protected] or use the chat on our website. We’ll be happy to help. 😉