In 2023, the FTC began warning about a scam that has only gotten more convincing since: a phone call from what sounds exactly like your son, daughter, or parent, panicked and asking for money after a car accident or an arrest. The voice is real in every way your ear can judge — same pitch, same speech patterns, same way they say your name. It just isn’t them. AI deepfakes like this are the everyday reality of the technology in 2026: not a niche curiosity, but a tool already showing up in phone scams, fake videos, and impersonation attempts aimed at ordinary people. According to the FTC’s own consumer alert, scammers only need a short clip of someone’s voice, often pulled from a public social media video, to clone it convincingly enough to fool a scared relative.
What a Deepfake Actually Is
A deepfake is media — video, audio, or images — generated or altered by AI to convincingly show someone doing or saying something they never did. The technology overlaps heavily with the diffusion and generative models covered in our guide to how AI video generators work: the same tools that let a filmmaker generate a believable scene from a text prompt can, pointed at someone’s face or voice instead, produce a convincing impersonation. Voice cloning needs far less source material — sometimes just a few seconds of clear audio is enough to generate new speech in that person’s voice.
Why They’ve Gotten So Convincing So Fast
A few years ago, deepfakes were easier to catch: flickering edges around a swapped face, a slightly robotic voice, unnatural blinking. Newer models have fixed most of those specific tells, the same consistency improvements that make current AI-generated video look production-ready. The tools have also gotten cheaper and more accessible, which is a large part of why deepfake scams have moved from rare novelty to a regular fixture in scam reports and social feeds.
What the Law Actually Says
The clearest U.S. legal response so far is the TAKE IT DOWN Act, signed into federal law on May 19, 2025 and enforced by the FTC starting exactly one year later, on May 19, 2026. Per the FTC’s own enforcement guidance, the law covers both real intimate images shared without consent and “digital forgeries” — content created or altered with AI to falsely depict someone. Covered platforms must give people a clear way to request removal, take the content down within 48 hours of a valid request, and remove identical copies too, with penalties reaching over $53,000 per violation for platforms that don’t comply. It’s narrower than a general “deepfake ban,” targeting nonconsensual intimate imagery specifically, but it’s the first federal law to explicitly name AI-generated digital forgeries as covered content.
How Platforms Are Trying to Label AI Content
Since visual tells are becoming less reliable, the tech industry has leaned on labeling content at the source instead of detecting fakes after the fact. Content Credentials, built on the C2PA standard, embeds a record of how a piece of media was created and edited directly into the file, visible as a small “cr” pin that viewers can click to see its creation history. It’s backed by more than 500 companies, including Microsoft, Adobe, Google, Meta, OpenAI, and Sony, and is increasingly built into cameras, editing software, and generative AI tools themselves. It isn’t a magic detector — credentials can be stripped during editing or re-uploading, and it only works when the original creation tool supports it — but it’s currently the most concrete industry effort to make a piece of media’s origin checkable rather than guessable.
How to Actually Spot One Right Now
Visual and audio inspection alone is no longer a reliable defense, but a few signals still hold up. Content credentials metadata, when a platform preserves it, is more consistent than anything visible to the eye. Beyond that, mismatched lighting between a face and its background, audio that doesn’t quite sync with lip movement, and unnatural pauses in cloned speech remain common in lower-effort fakes. The more reliable habit isn’t visual forensics, though — it’s verification through a second channel: if a video or call is designed to make you act fast on an urgent, emotional request, pause and confirm it through a method the sender doesn’t control, like calling a known number directly instead of replying on the same channel it arrived on.
Voice Clones and the Scam Connection
Voice cloning deserves its own mention because it’s the deepfake format most likely to target regular people directly, not public figures. The FBI has repeatedly warned about AI-generated voice messages used to impersonate officials and, more commonly, worried family members calling with a fabricated emergency. A pre-agreed family code word, a habit of hanging up and calling back on a known number, and the same skepticism covered in our guide to spotting phishing scams are the most effective defenses right now, since none of them depend on being able to tell a real voice from a cloned one in the moment.
None of this means every piece of AI-touched media is a threat — most is used for ordinary things, from marketing clips to accessibility tools. The shift worth remembering is that convincing no longer means real.
FAQs
Is it illegal to create a deepfake of someone?
It depends on what it depicts and where you are. The federal TAKE IT DOWN Act criminalizes nonconsensual intimate deepfakes and requires platforms to remove them quickly, and a growing number of states have their own laws covering election-related or fraudulent deepfakes. A deepfake made purely for satire or parody without deception generally falls into murkier legal territory that varies by state.
Can deepfake detection software reliably catch fakes?
Not consistently. Detection tools exist and can flag some AI-generated content, but they’re in a constant arms race with generation tools that improve specifically to evade them. Provenance-based approaches like Content Credentials, which label content at creation rather than detecting fakes afterward, are generally considered more durable than after-the-fact detection.
How much audio does someone need to clone a voice?
Current tools can produce a usable clone from a very short clip — sometimes just a few seconds of clear speech, often pulled from a public social media video or voicemail greeting. That’s why the FTC specifically warns people to be cautious about how much of their own voice is publicly posted online.
What should I do if I find a deepfake of myself or someone I know?
Document it with screenshots including the URL, report it directly to the platform using its removal request process, and file a complaint at ReportFraud.ftc.gov if it involves a scam. If it’s a nonconsensual intimate deepfake, the platform is legally required under the TAKE IT DOWN Act to remove it within 48 hours of a valid request.
Are deepfakes always used maliciously?
No. The same underlying technology powers legitimate uses like film dubbing and accessibility tools that restore lost voices, and most AI-generated media people encounter daily isn’t deceptive at all. The concern isn’t the technology itself — it’s the small share of use cases built specifically to deceive, defraud, or harass someone without consent.
Discussion about this post