What synthetic media is
Synthetic media is audio, images or video that has been generated or heavily altered by software. Some of it is harmless or useful, such as a synthesized voice for accessibility or an illustration for a presentation. The term deepfake usually refers to the deceptive end: a fabricated recording that appears to show a real person saying or doing something they did not.
The quality of this material has improved, and the tools to make it have become easier to use. That does not mean every call or clip is fake, and it would be a mistake to become paranoid. It does mean that seeing or hearing something is no longer, on its own, strong proof that it is real. This article is general awareness and not security advice tailored to your situation.
How businesses can be affected
Common scenarios fall into a few groups.
- Impersonation for payment fraud. A caller who sounds like a senior executive asks an employee to make an urgent transfer or share credentials. This builds on older scams that used only email, with a convincing voice added.
- Fake video or audio of staff or leaders. A fabricated clip can be used to spread false statements, embarrass a company or move opinion.
- Fake identity documents or photos. Generated images may be submitted in onboarding or verification processes.
- Fabricated evidence. Altered images or recordings can be introduced in disputes, claims or complaints.
- Reputation attacks and misleading ads. A brand’s name or a public figure’s likeness may be used to promote scams.
Many of these combine with phishing. The technology adds believability, but the underlying trick is usually familiar: create urgency, impersonate authority, and push someone to skip normal checks. The newer techniques used in phishing are covered in more depth elsewhere.
Warning signs, with limits
People sometimes look for visual or audio glitches: odd blinking, unnatural skin, mismatched lighting, warped hands or text, a flat or oddly paced voice, lip movements that do not match. These can be clues, but they are unreliable. Good fakes may have none of them, and genuine low-quality recordings often show some.
Behavioral signs are generally more dependable than technical ones.
- The request is urgent and discourages verification.
- It asks for secrecy or bypasses the normal process.
- It involves money, credentials or confidential information.
- The channel is unusual for that person, such as a sudden message from a new number.
- The details do not quite fit what you know about the situation.
Detection software exists, but its results are often uncertain and should not be treated as a final verdict. Use it as one input at most.
Process beats perception
Because people cannot reliably spot fakes by eye or ear, the strongest defenses are procedural. Organizations often adopt measures like these.
- Call-back verification. For payment changes and sensitive requests, confirm through a known contact method, not the number or link supplied in the request.
- Two-person approval. Require a second authorized person for transfers above a set threshold.
- Agreed verification phrases or questions for senior staff who are often impersonated, used sparingly and kept private.
- Clear rules that no leader can bypass the process by phone or video, so employees feel safe saying no.
- Reduced public exposure of voice and video samples where practical, since fabricators need material to work from.
Training matters. Short, realistic exercises help staff practice pausing and verifying. The tone should be supportive: an employee who stops a suspicious request and checks it has done the right thing, even if the request turns out to be real. A sound staff training program can include these scenarios.
If you receive or are targeted by a fake
A calm, prepared response limits damage.
- Preserve the evidence: save the file, the message, links and timestamps rather than deleting it.
- Do not act on the request, and do not forward the material widely, which can spread it.
- Report internally through the agreed route so the right people can assess it. An escalation path for AI-related incidents should cover this.
- If money or credentials were involved, contact your bank, IT or security team immediately. Speed often matters.
- For public fakes, consider reporting to the hosting platform, which often has a process for impersonation and manipulated media.
- Consider legal advice and, where appropriate, law enforcement. Laws on deepfakes are developing and vary by place.
- Communicate clearly and factually with affected customers or staff, without amplifying the fake.
Using synthetic media yourself
Businesses also create synthetic material, such as stock-style images, voiceovers or avatars. Doing so responsibly means not impersonating real people without permission, avoiding content that could mislead audiences, and considering whether to label it. The broader question of telling people when AI is involved applies here, and some platforms and jurisdictions have their own labeling expectations.
Keep in mind that copyright and likeness rights can be unsettled for generated content, and that a person’s voice or image may carry legal protections in some places.
Keeping perspective
The practical lesson is not that nothing can be trusted, but that important decisions should not hinge on a single call, clip or image. Build verification into the routine for anything involving money, access or reputation, review the policy occasionally, and assume the techniques will keep changing. No approach eliminates the risk, but a team that habitually verifies is a much harder target.