Only 0.1% of People Can Spot a Deepfake — Here's What Still Works
Two thousand people were shown a mix of real and AI-generated images and video. They were warned in advance that some were fake and told to look for them. One in a thousand got them all right — and the ones who got it wrong were about as confident as the ones who got it right. So the useful question is not how you spot a fake. You don't. It's which check you fall back on instead, and whether that check still holds.
The Promise
- One check still holds, and it holds for a structural reason rather than a technical one. A callback on a number that was already in your phone asks the attacker to control infrastructure they don't have, and no improvement in generation touches that.
- The fix costs nothing. Write down the verification step you actually use, find it on the ranking, and close the weakest path you rely on. That is a conversation, not a project.
- There is a single test that sorts any verification method, including ones that haven't been invented yet: does this ask the attacker to produce something, or to possess something?
The Risk
- Recognising a voice is finished as a control. Microsoft Research published VALL-E three years ago with a usable clone from three seconds of enrolled audio. Your voicemail greeting is longer than that.
- Participants were about 36% less likely to catch a synthetic video than a synthetic still. That inverts the common assumption that moving footage is stronger evidence than a photograph, and it means switching to a video call is a lateral move onto ground the attacker already holds.
- Suspicion is not a defence. Andrew Bud, who founded iProov, flagged that even when people do suspect a fake, the vast majority take no action at all — which produces the same outcome as never noticing.
- The shared-context question that saved a Ferrari executive in July 2024 has a sharp failure condition: it only works while the attacker is outside. Three weeks inside the mailbox and they know about the book too.
The number, and who benefits from it
Two thousand people were shown a mix of real and AI-generated images and video. Primed, warned, paying attention. One in a thousand got them all right.
The part that should bother you more than the number is that their confidence barely moved. People who got it wrong felt about as sure as people who got it right.
The study came from iProov in February 2025, and it’s worth saying plainly that iProov sells biometric identity verification, so a finding that humans cannot do this job supports what they sell. I still trust the shape of it — two thousand participants, published method, an independent academic commenting on it — but you should know who benefits from a number before you carry it around.
Professor Edgar Whitley at the London School of Economics, commenting independently on the same study, called it a significant challenge to our ability to tell truth from falsehood. That is an odd sentence to meet in a security briefing. It is also the correct one.
Video is harder than stills, which is backwards
The detail I keep returning to: participants were about 36% less likely to identify a synthetic video than a synthetic picture.
Sit with that, because it inverts what most of us assume. We treat moving footage as more evidence than a photograph. Measured, the opposite holds.
Now pair it with what generation costs. Microsoft Research published VALL-E three years ago, and the headline result was a usable voice clone from a three-second enrolled recording. Three seconds. Not three minutes of clean studio audio. Your voicemail greeting is longer than that, and so is the first sentence of any webinar you have ever spoken on.
CISA quietly retired “look for bad grammar” from its own guidance page for exactly this reason. The phishing version is the easy case, though, because there you are at least reading something. Here, the thing being faked is the evidence you were going to use to check.
The checks, ranked weakest first
Almost everyone I talk to has the same instinct: verify on another channel. The instinct is right and it is incomplete, because another channel is not one thing. Some of those channels have already fallen, some still hold, and hardly anybody has put them in order.
Recognising a voice. Gone. Not weakening — gone. Three seconds of public audio and the voice on the phone is whoever the attacker wants it to be. If your verification step is it sounded like him, you no longer have a verification step. You have a feeling.
Moving to video. This is the one that catches people out, because it feels like an escalation. It isn’t. A face swap injects into a call through a virtual camera, and synthetic video is the format humans are measurably worst at.
A shared-context question. Now we’re somewhere. This is what saved a Ferrari executive in July 2024. “Sorry, Benedetto, but I need to identify you,” he said to a voice that matched his chief executive exactly, and asked for the title of a book the real man had recommended days earlier. The call ended. A real defence, and it worked. But shared context is only secret while the channel carrying it was never breached. If they have been sitting in the mailbox for three weeks reading the correspondence — which is what a business email compromise actually is — then they know about the book.
A callback on a number you already had. This one holds, and it holds structurally rather than technologically. Everything above asks the attacker to fake content: a voice, a face, a fact. This asks them to control infrastructure they do not have.
Produce, or possess
The strength of a check has nothing to do with how convincing it feels. What matters is whether it asks the attacker to produce something or to possess something.
I’ve watched this exact re-ranking happen in cybersecurity before. Nothing about the defence failed. A set of controls silently changed rank, and nobody resorted the list. That gap — not the deepfake itself — is where the loss happens.
Producing is cheap now and getting cheaper: a voice, a face, a plausible sentence, a document, a shared memory scraped out of a mailbox. A great deal of what is currently marketed as deepfake defence asks a machine to be better than a human at spotting produced content. That may work for a while. It is a race against the thing getting cheaper fastest, and that is not the side of the ledger you want your controls sitting on.
Three things, none of which cost anything
One. Write down the verification step you actually use today, in the words you’d use to describe it to a colleague, then find it on that ranking. Most people discover they are sitting on one of the top two rungs and had assumed they were near the bottom.
Two. Fix the weakest one you rely on. If your finance approval path can be satisfied by a familiar voice, that path is open right now, and closing it is a conversation rather than a project.
Three. Agree a word. The personal version of possession is a word agreed in person with the people who might ever ring you in trouble — your kids, your parents, your grandparents. A word never spoken on a digital medium is not producible by an attacker, no matter how good the voice gets. One conversation, and it does not expire.
Stop asking whether you could spot a fake. You could not, and neither could I. Ask instead whether your check requires them to produce something or to possess something. That question survives whatever gets released next.