Real-time deepfakes have killed the comfort of the video call.

The good news is that the thing that keeps you safe was never your eyes in the first place.

Artificial intelligence, we are assured, is here to help. And help it has. It has also automated the lie, industrialised the forgery, and made the impossible video call merely a Tuesday. We worry about the right things in the wrong order and miss the simplest fact of all, the first people to truly master this technology were never the founders or the futurists. They were thieves. The face is the whole game now. Deepfakes have come a long way from the wobbling filter that slid off your chin when you turned your head. Today a scammer can sit at an ordinary desk, in front of an ordinary webcam, and have software paint a borrowed face over theirs in real time that maps every blink, every lopsided smile, every “hmm, let me think,”  while a cloned voice runs in parallel, doing the same theft to someone's vowels. The old tell, the reluctance to get on video, is gone. They want to be on video now. The camera used to be the lie detector. They've turned it into the costume.

In early 2024, a finance worker at a multinational in Hong Kong joined a video call with her chief financial officer and several colleagues. Familiar faces. Familiar voices. She was asked to move twenty-five million dollars for a confidential acquisition urgent, sensitive, the kind of thing you don't make a fuss about. So, she didn't. She authorised it. The money was gone within hours, and so, it turned out, were the people. Every single face on that call was synthetic. She had spent the meeting alone, talking to ghosts wearing her colleagues' skin.

It also happens, at smaller scales, somewhere in the world, most weeks to grandparents and graduate recruits and people who are very, very good at their jobs. The thing that undid her was her humanness. It was trust, pointed in the right direction, arriving at the wrong moment.

You have probably seen the clip. Someone on a call is asked to hold three fingers up in front of their face, the scammer stalls and squirms and finally drops the line, and the internet cheers. It is enormously satisfying to watch, and there is a real principle underneath it. When a hand passes over a face, it creates what's called occlusion — it blocks the eyes, the nose, the jawline that the software uses as anchor points. Cheap, fast deepfake tools were never built for that. The mask slips. The edges smear. The illusion falls apart in your hands, literally.

Every time one of these tells spreads across TikTok, it hands the criminals a to-do list. The people who build deepfake detection tools — the ones who do this for a living — are already saying that the better real-time models handle the hand-wave and the head-turn without flinching. Lean on the trick too hard and it does something worse than nothing, it gives you false confidence. A scammer doesn't need a flawless fake. They only need one good enough to survive the single test you happen to know.

So by all means, keep the physical tests in your pocket. Ask the person to turn their head fully to the side, until they're in profile because older fakes will let the jaw drift and stretch. Ask them to wave a hand slowly between their face and a lamp, because real-time fakes still struggle to throw a shadow that behaves. Watch for eyes that don't quite move like eyes, lighting that doesn't match the room, just don't mistake any of it for a seatbelt.

The most useful thing I can tell you is almost boring. The people who don't get burned are not the ones with the sharpest eyes. They are the ones built the verification into the routine, so that being careful didn't depend on being suspicious in the heat of the moment. That is the real foolproof method. Not a trick,  a habit.

Here is what that looks like in practice.

1.   Hang up and call back on a number you already have. Not the number that called you. Not a number anyone gives you mid-call. The saved one, the one in your own contacts. No amount of AI can answer a phone it doesn't control. This single move defeats almost every scam.

2.   Agree on a code word — for your family and your team. A word that lives nowhere online. If a panicked voice asks you to move money or rescue someone, you ask for the word. A real daughter knows it. A deepfake trained on her holiday photos does not.

3.   Ask the question only the real person could answer. Not your mother's maiden name, that's been for sale on the dark web for years. Ask about the thing that isn't written down anywhere like the meeting you have tomorrow, where you got that scar, what went wrong on the drive home last week.

4.   Treat urgency plus secrecy as the alarm itself. These attacks live and die on hurry and discretion “it has to be now,” “don't tell anyone yet.” That combination is not a sign of importance. In this context it is, far more often, the shape of the trap. Slowing down is not rudeness. It is the defence.

5.   Make verification a workflow, not an instinct. If you run a business, no money moves on the authority of a video call, full stop. Build a second channel and a second human into every transfer above a threshold. Run a drill. The teams who survive these attacks decided how they'd verify long before anyone tried to fool them.

6.   Starve the machine of training data. Every public photo of your face and clip of your voice is raw material. You don't have to vanish, just be a little less generous. Lock down what doesn't need to be open. The smaller your footprint, the harder you are to wear.

7.   Let the tools help where they can. Phones and platforms are starting to fight back — some can now flag a call that doesn't match the device it claims to come from. Turn those protections on. But hold them loosely because they are a seatbelt, not a chauffeur. The judgement still has to be yours.

It feels genuinely bleak that we have arrived at a place where you can't trust the evidence of your own eyes. I won't pretend otherwise; but here is the quiet mercy in it. The eyes were never the strong part anyway. Eyes can be fooled by a card trick, a costume, a confident stranger. What can't be cloned is the texture of a real relationship, the small private history that no model has ever been fed.