Deepfakes Explained: How AI Fakes Are Made, Spotted and Policed

Deepfake technology is a form of artificial intelligence that creates realistic fake videos, audio, or images of real people. The name blends “deep learning” with “fake”. A deepfake can make someone appear to say or do something they never did, using their face, voice or body without consent.

What started as a niche hobby in 2017 is now a mainstream tool for fraudsters and abusers, as well as film studios. UK law has changed quickly in response. Our fake news spread statistics show how fast synthetic media volumes have grown.

This guide explains how deepfake technology works, from older GAN models to today’s diffusion and voice cloning systems. It covers the main types of deepfakes, why spotting fakes by eye no longer works, and which detection methods hold up. It also sets out the law in England and Wales, Scotland, Northern Ireland and Ireland, and what to do if you’re targeted.

What Is Deepfake Technology?

A deepfake is synthetic media: content generated or altered by a machine learning model so that it misrepresents a real person. The key difference from ordinary editing is that the software learns what a person looks and sounds like, then produces new material on its own.

The term first appeared in late 2017, when a Reddit user called “deepfakes” began posting face-swapped videos. Most of those early clips were sexual videos of female celebrities made without consent. That origin still shapes how the technology is misused today.

Deepfakes differ from two neighbouring ideas. Traditional CGI is built frame by frame by artists. “Cheap fakes” are simpler edits, such as slowing a clip down to make a speaker seem drunk. Deepfake technology sits between the two: it automates realism, so one person with a laptop can produce what once needed a studio.

That automation turns deepfakes into a security problem. Criminals use them to impersonate trusted people, which is a new twist on classic social engineering attacks.

How Deepfake Technology Works

Several families of AI model sit behind modern deepfakes. Each learns from examples of real faces or voices, then generates new content that follows the same patterns. Knowing how they differ explains why older detection advice has aged so badly.

Generative Adversarial Networks: The Original Engine

Generative adversarial networks, or GANs, were introduced by researcher Ian Goodfellow and colleagues in 2014. A GAN pairs two neural networks that compete. The generator creates an image, and the discriminator judges whether it looks real.

Over thousands of rounds, the generator learns from each verdict until its output is hard to tell apart from real photographs.

Autoencoders and Face Swapping

Most early face-swap videos used autoencoders rather than GANs. An autoencoder compresses a face into a compact code that captures expression, angle, and lighting. A decoder then rebuilds a face from that code.

To swap faces, a creator trains one shared encoder on two people and a separate decoder for each. Feed in person A’s expression and decode it with person B’s decoder, and B appears to make A’s movements. It needs plenty of footage of both people.

Diffusion Models and Multimodal Generators

Diffusion models now drive most high-end image and video generation. They learn by adding random noise to real images, then training a network to reverse the process step by step. Latent diffusion runs that process in a compressed space, which makes it fast enough for consumer hardware.

Diffusion models handle hands, teeth, hair, and lighting far better than early GANs. Many can also take a text prompt and a single reference photo, then produce a new image or clip of that person. That low barrier is why non-consensual image generation exploded in 2025 and 2026.

Neural Voice Cloning

Voice deepfakes use text-to-speech models paired with a neural vocoder, which turns predicted sound features into a natural waveform. Modern systems can clone a voice from short samples, then speak any sentence in it. Microsoft’s VALL-E research model showed this “zero-shot” approach in January 2023.

People are poor judges of synthetic speech. A 2023 University College London study of 529 listeners found they identified deepfake speech only 73% of the time. Training improved their results only slightly. Voice is often the cheapest and most convincing form of deepfake technology available to a fraudster.

The table below summarises how these approaches compare.

Model type	Main output	Typical weakness	Real-time capable?
GAN	Still images, face re-enactment	Unstable training, odd artefacts in older versions	Partly
Autoencoder	Face-swap video	Needs lots of footage of both people	Yes, with good hardware
Diffusion model	Images and video from text or photos	Slower, heavy computing for long video	Increasingly
Neural voice clone	Speech in a target voice	Emotion and breathing can sound flat	Yes

The Main Types of Deepfake

Deepfakes fall into a handful of practical categories. Each one creates different risks, so it’s worth knowing which type you might meet on a phone call, a video meeting, or a social feed.

Face Swaps and Facial Re-enactment

A face swap places one person’s face onto another person’s body in a video. Re-enactment keeps the original face but changes its expressions or lip movements to match new audio. Both are used in political fakes, fake celebrity adverts, and harassment.

In the UK, fake adverts show well-known presenters or politicians appearing to endorse investment schemes. Our guide to spoofing attacks explains how these impersonations combine with fake websites and caller IDs.

Voice Clones and Vishing

Voice cloning powers “vishing”, or voice phishing. The criminal calls a victim using a cloned voice of a boss, relative or official. One early case came in 2019. The head of a UK energy firm sent €220,000 after a call from a cloned “chief executive” of its German parent.

Voice clones also target families. A caller who sounds like a son or daughter claims to be in trouble and needs money fast.

Live Video Injection and Liveness Bypass

The newest threat is real-time deepfake technology used on live calls. Attackers route a synthetic face through virtual camera software, so a video meeting app treats it like an ordinary webcam. The fake can respond, blink, and talk back in real time.

The same trick targets identity checks, where apps ask users to film their face to prove they’re present. Injection attacks feed a deepfake straight into that process, skipping the physical camera entirely. Fraudsters use this for identity theft, opening accounts or taking over existing ones in a victim’s name. Our separate guide to deepfake technology threats covers business fraud cases and finance team controls in detail.

Non-Consensual Intimate Imagery

Sexual deepfakes remain the most common form of abuse. So-called “nudification” tools take an ordinary clothed photo and generate a fake nude image. Victims are overwhelmingly women and girls.

In January 2026, the Grok AI tool on X was widely used to “undress” real women and children in public posts. Ofcom opened an investigation into X on 12 January 2026. The Information Commissioner’s Office later opened a formal investigation into X and xAI. Parents worried about children’s photos can read our guide to sharing pictures of children safely.

Legitimate Uses of Deepfake Technology

Not every deepfake is harmful. The same tools support film, accessibility and education, and consent is what separates these uses from abuse.

Film and television studios use face and voice synthesis for dubbing, de-ageing and visual effects. In 2021, AI firm Sonantic recreated the speaking voice of actor Val Kilmer, who lost much of his voice after throat cancer. David Beckham appeared to speak nine languages in a 2019 Malaria Must Die campaign, using synthetic video.

In healthcare, people diagnosed with motor neurone disease can “bank” recordings of their voice before speech is lost. A synthetic version then lets them keep talking in their own voice through a communication device.

Museums use it too: the Dalí Museum in Florida launched “Dalí Lives” in 2019, with a synthetic Salvador Dalí greeting visitors. In each case, audiences knew what they were seeing.

Why Spotting a Deepfake by Eye No Longer Works

Much online advice still tells you to watch for unnatural blinking, blurry edges or mismatched lip movements. That advice made sense for early face swaps. It’s now misleading, because modern models have largely fixed those flaws.

The evidence is stark. In a 2025 iProov study of 2,000 UK and US consumers, only 0.1% correctly identified every real and fake image and video. Participants had been told to look for fakes, so real-world performance is likely worse. Deepfake videos were harder to catch than images, with people 36% less likely to identify a synthetic video correctly.

Viewing conditions make it worse. Compressed video calls, re-encoded uploads, and small phone screens hide the tiny glitches that checklists rely on.

A better approach treats unexpected audio or video as unverified until something else confirms it. That mindset holds up, however good deepfake technology becomes.

Detecting Deepfakes: Tools, Provenance and Verification

Since people can’t reliably spot fakes, attention has moved to software, signed media records, and procedures. None works alone.

Automated Detection Tools and Their Limits

Detection tools use machine learning to look for statistical traces that generation models leave behind. They check pixel patterns, frequency noise, audio spectra, and inconsistencies between frames.

Their weakness is that they learn from yesterday’s fakes. The Deepfake-Eval-2024 benchmark tested open-source detectors against real deepfakes that circulated online in 2024. Performance fell by around half compared with older academic datasets: 50% for video, 48% for audio and 45% for images.

The UK government is trying to raise standards. In February 2026, the Home Office announced a deepfake detection evaluation framework, developed with Microsoft, academics and other experts. It will test tools against real threats such as fraud, impersonation and sexual abuse material.

Content Credentials and Cryptographic Provenance

Provenance flips the question. It asks whether a file can prove where it came from. The Coalition for Content Provenance and Authenticity, known as C2PA, publishes the open standard behind Content Credentials.

A Content Credential is a cryptographically signed record attached to a photo, video, or audio file. It can show the capture device, the time, and any edits made afterwards, including AI edits. If someone tampers with the file, the signature no longer matches.

Adoption is growing. Google’s Pixel 10 phones, launched in 2025, add Content Credentials to every photo taken with the Pixel Camera app. You can check a file by uploading it to the free Content Credentials verification tool.

The limit is that missing credentials prove nothing. A screenshot or a re-upload can strip the data, and most genuine content online still carries none. Provenance helps confirm authentic media, but it can’t flag every fake.

Verification Habits That Beat Any Fake

The most reliable defence costs nothing: confirm surprising requests through a channel you control. If a “relative” calls asking for money, hang up and ring them on the number saved in your phone. If a “manager” appears on video with an urgent payment request, check with them through a separate route.

Ask a question only the real person could answer. Take your time, because urgency is the fraudster’s main tool.

The table below compares the main detection approaches.

Method	How it works	Main weakness	Best used for
Visual inspection	Looking for glitches and odd movement	Modern fakes remove most flaws	Not recommended alone
Automated detectors	AI scores the likelihood of manipulation	Falls behind new generators	Screening large volumes
Content Credentials	Signed record of origin and edits	Easily stripped; not yet widespread	Confirming authentic media
Out-of-band checks	Confirming through a separate trusted channel	Relies on people following the process	Payments and urgent requests

Is Deepfake Technology Legal in the UK and Ireland?

Creating a deepfake isn’t automatically a crime. The law targets specific harms, especially sexual imagery, fraud and harassment. The rules also differ across the UK’s nations and in Ireland.

England and Wales

Sharing an intimate image without consent, including a deepfake, became an offence on 31 January 2024. The Online Safety Act 2023 inserted this offence into the Sexual Offences Act 2003. It’s also a priority offence, so platforms must act to prevent and remove such content.

Creation is now covered too. Since 6 February 2026, it has been an offence to create a purported intimate image of an adult without consent. Section 138 of the Data (Use and Access) Act 2025 added it. Asking someone else to create one is a separate offence. Prosecutions can be brought up to three years after the offence.

The Crime and Policing Act 2026 went further, targeting the tools themselves. It received Royal Assent on 29 April 2026. A new offence of making, adapting or supplying nudification tools came into force on 29 June 2026. The Act also introduces duties for platforms to take down non-consensual intimate images within 48 hours.

Fraud using a deepfake is charged under existing law, mainly the Fraud Act 2006. Impersonating someone to obtain money is fraud whether the method is a letter, an email or deepfake technology.

Scotland, Northern Ireland and Ireland

Scotland’s Abusive Behaviour and Sexual Harm (Scotland) Act 2016 already covers sharing intimate images that have been altered. At the time of writing, Northern Ireland has no specific offence covering the creation or sharing of sexual deepfakes of adults. Justice Minister Naomi Long consulted on one in 2025, and in May 2026 proposed adding it to the Criminal Justice (Sentencing etc.) Bill.

In Ireland, Coco’s Law (the Harassment, Harmful Communications and Related Offences Act 2020) criminalises sharing intimate images without consent. In January 2026, the Garda National Cyber Crime Bureau confirmed this applies to AI-generated images. A private member’s bill to criminalise creation explicitly passed the second stage in February 2026 without government opposition.

The EU AI Act and Deepfake Labelling

The EU AI Act adds transparency duties that reach UK firms serving EU users. Under Article 50, anyone deploying an AI system to create deepfakes must disclose that the content is artificial. These duties have applied since 2 August 2026.

Providers of generative tools must also mark outputs in a machine-readable way. The EU’s Digital Omnibus gave tools already on the market until 2 December 2026 to meet that marking duty.

What to Do If You’re Targeted by a Deepfake

Being deepfaked can feel overwhelming, but there are clear steps to take. Acting quickly limits how far the content spreads.

Start by saving evidence: screenshots, web addresses, account names, dates, and times. Don’t reply to anyone threatening you, and never pay a blackmail demand. Our guide to cyber blackmail explains how these threats usually unfold.

If the image is sexual, adults can use StopNCII.org to create a digital fingerprint, called a hash, on their own device. Partner platforms use the hash to block uploads, and the image itself never leaves your phone. The Revenge Porn Helpline offers free support to adults in the UK. Anyone under 18 should use Childline and the Internet Watch Foundation’s Report Remove tool instead.

Report the content to the hosting platform. If it isn’t removed, Report Harmful Content, run by the UK Safer Internet Centre, can help. In Ireland, Hotline.ie handles reports of intimate image abuse.

Report crimes to the police. In England, Wales and Northern Ireland, fraud goes to Report Fraud, which replaced Action Fraud in December 2025. Intimate image abuse should go to your local police force on 101, or the PSNI in Northern Ireland. In Scotland, contact Police Scotland on 101. In Ireland, contact your local Garda station.

Deepfake technology will keep improving, and no checklist will stay current for long. The habits that work are simple: slow down, question urgency, and confirm through a route you trust.

The law is catching up too, although Northern Ireland and Ireland are still closing gaps that England and Wales have filled.

If money has left your account, call your bank straight away or dial 159 in the UK.

Frequently Asked Questions

These answers cover the questions readers ask most often about how deepfakes work and where they’re used.