What Are Deepfakes? How AI Creates Fake Faces, Voices and Videos | Deepfake Detection for Beginners Day 1 of 7

Deepfake defence starts before any tool. It starts with understanding what you’re defending against, and the honest answer is that most people I meet — including security professionals — carry an outdated mental model of what current AI can produce. Today closes that gap. Before we cover any detection techniques on Days 2 through 4, I want you to know exactly how the fakes are made and what makes them dangerous. If you haven’t yet checked your own attack surface, run your email through the Email Breach Checker — the data attackers use to train deepfakes of you starts with the identity data already exposed in breaches. This course lives inside the AI Deepfake Hub alongside my How to Spot AI Deepfakes 2026 reference guide, and everything ties back to the LLM Hacking Hub as the master AI security cluster.

What a Deepfake Actually Is — The Real Definition

I get the same first question in every deepfake awareness training I run: “is a Photoshop edit a deepfake?” The answer is no, and understanding why draws the line that matters for the rest of this course.

A deepfake is synthetic media in which AI has altered, replaced, or entirely generated a person’s appearance, voice, or words. The key word is synthetic: it looks real, sounds real, feels real, but was generated or manipulated by an algorithm — not by a camera capturing actual reality or by a microphone recording an actual person speaking.

Three sub-categories sit under that umbrella. First: altered — something real was changed. A video of a politician has been subtly edited so the words come out differently, or a photo has had a face swapped in. Second: reenacted — someone’s expressions or lip movements have been transferred onto their face while the face itself is preserved. This is the “put words in their mouth” category. Third: entirely synthetic — the person never existed, or the recording never happened. This is the most dangerous category in the real world, because it means the video or audio of a real named person saying or doing something they never said or did.

Here’s where the Photoshop question gets its answer. Photoshop is manual pixel editing — a human moves and modifies specific pixels one by one, or with brushes and filters, to change what an image shows. A deepfake is generated. The AI model has learned the target’s appearance from thousands or millions of images and produces new images that are statistically consistent with that appearance. This distinction matters enormously because the detection techniques are completely different. When I check a suspicious image for Photoshop editing I look for one set of artifacts. When I check it for AI generation I look for another set entirely. Day 2 covers both — and I always run both checks when I’m not sure which type of manipulation happened.

How AI Creates Fake Faces — GAN and Diffusion Explained Simply

I always explain GANs the same way when I’m training analysts new to the space — as a counterfeiter working against a detective, both getting better at their job at the same time.

The GAN — Generative Adversarial Network — is a two-network system. The Generator’s job is to create fake faces. The Discriminator’s job is to detect whether faces are fake. They train against each other. The Generator produces a face. The Discriminator scores it: “That was 73% convincing.” The feedback flows back to the Generator: “Improve these specific features.” Millions of iterations later, the Generator produces faces so realistic that the Discriminator — a network specifically trained to detect fakes — can no longer reliably distinguish them from real photographs. That is the whole story of how sites like thispersondoesnotexist.com produce convincing faces of people who don’t exist.

Diffusion models take a completely different approach. They learn to denoise images — starting from random visual noise and progressively refining it toward a coherent image that matches target characteristics. Give a diffusion model the description “portrait of a young woman with brown hair, professional lighting” and it starts from noise and denoises step by step until a face appears. Diffusion models produce higher-quality output with more control than GANs, which is why they dominate AI image generation in 2026 — Stable Diffusion, Midjourney, DALL-E 3 are all diffusion architectures. Most of the AI-generated faces you’ll encounter in the wild in 2026 came from diffusion models, not GANs.

Face-swap deepfakes work differently again. The system extracts the source face’s landmarks — the exact positions of eyes, nose, mouth, chin, jaw. It then warps a target face to match those landmarks, and blends the warped face into the source video frame by frame. Modern tools like DeepFaceLab and its commercial successors do this in real time, at video frame rates, which is exactly what enabled the Hong Kong fraud we’re about to unpack.

Both architectures share one weakness that becomes the foundation of everything we do on Days 2 through 4: they learn from training data, so anywhere the training data is thin — ears in profile, unusual head angles, complex physics like eye reflections — the output is weaker. Every detection signal I teach you traces back to a place where the pipeline is thin.

The Four Deepfake Types You’ll Encounter

In every investigation I’ve been part of, the deepfake in question falls into one of exactly four categories. Knowing which type you’re looking at tells you where to look for the tells.

Face Swap. AI replaces one person’s face with another’s, typically in video. The target’s face is extracted, another person’s face is warped to match the target’s landmarks and lighting, and the result is composited back into the video frame by frame. Primary real-world use: non-consensual intimate imagery (NCII) — celebrity or civilian faces attached to intimate content the target never appeared in. Second most common use: fraudulent identity content — a real person’s face used in fake documents, fake job applications, or fake video call attendance.

Face Reenactment. The face stays the target’s, but the expressions and lip movements are transferred from someone else. Also called “puppet-mastering.” The most dangerous political use case sits here: making a real politician’s face appear to say words they never said, with their real face and lighting preserved. The reenactment attack is harder to spot than face swap because the face itself is authentic — only the motion is synthetic.

Full Synthesis. The person never existed. Every face on thispersondoesnotexist.com is full synthesis — an AI-generated portrait of nobody real. This category powers fake LinkedIn profiles used to build attacker networks, fake dating profiles used in romance scams, and fake social media personas used to spread disinformation. In 2026, the majority of newly-created fake social profiles use full synthesis faces because the technology is fast, free, and produces unique faces that can’t be reverse-image-searched to a real person.

Voice Clone. AI replicates a person’s voice from audio samples. Modern systems produce convincing clones from as little as three seconds of audio. Voice clone is the most dangerous category for personal financial fraud in 2026 because it happens in real time during phone calls, requires no video, and exploits the deep evolutionary trust humans place in familiar voices. The Hong Kong fraud combined video face-swap with voice clone. The voice component was arguably more convincing than the video.

Four types, four different attack surfaces, four different detection approaches — which is why this course spends a separate day on each modality. Day 2 handles faces. Day 3 handles video. Day 4 handles voice. Day 5 puts all three into the attack chains criminals actually use.

The $25 Million Fraud — What a Real Attack Looks Like

When the Hong Kong fraud hit the news in February 2024, I sat down with the details for two hours and mapped the attack chain step by step. What I found was not a technical breakthrough — it was a repeatable process using tools already available to anyone.

Here’s the sequence as it unfolded. Attackers identified the target: a finance employee at a multinational firm in Hong Kong, someone with authority to approve significant wire transfers. Standard reconnaissance told them who the CFO was and who reported to him. Then came the OSINT phase — the attackers collected publicly available video and audio of the CFO from company presentations, media interviews, and internal webinars that had leaked online. Enough training data for both face and voice.

Model preparation took a day or two. A face-swap model was tuned on the CFO’s face at multiple angles. A voice clone was generated. Critically, the attackers didn’t just prepare one deepfake — they prepared several, of multiple people the target would recognise from the same organisation. This is what made the attack devastating.

The delivery: the target received a video call invitation, ostensibly from the CFO, with several other executives attending. He recognised the CFO’s face and voice immediately. He also recognised the other people on the call — because they were also deepfaked. Every single participant in that meeting except him was AI-generated in real time. The CFO explained an urgent, confidential acquisition situation requiring immediate wire transfer approval. The other attendees confirmed the plan in the way real colleagues would. Contextual plausibility overwhelmed the target’s initial scepticism. He approved the $25 million transfer.

The detection opportunity was there the entire time. Before approving the transfer, the target could have hung up and called the CFO directly on a phone number he already had saved. Sixty seconds of out-of-band verification would have stopped the entire attack, because the real CFO would have answered and said “I never asked for that.” Sixty seconds. That verification protocol — which we cover in depth on Days 4 and 7 — is the single most important defence in this entire course. And it works regardless of how convincing the deepfake is.

The Creation Pipeline — From Target to Fake

I teach the creation pipeline in every deepfake awareness class because understanding it reveals exactly where detection is strongest. You cannot spot what you do not understand.

The pipeline runs through five stages. Training data collection — the attacker gathers images, video, or audio of the target from public sources. Quality and quantity both matter enormously here. Ten photos from one angle produces a much lower-quality deepfake than a hundred photos from multiple angles and lighting conditions. Three seconds of audio produces a viable voice clone; three hours produces a near-perfect one. Model selection — the attacker picks the right architecture for the goal. Full synthesis of a new face? A diffusion model. Swapping an existing face into video? A face-swap model like DeepFaceLab. Real-time video call impersonation? A dedicated real-time face conversion tool. Generation — the model runs. This can take seconds (for a still image) to hours (for a video sequence at high quality). Quality review — the attacker checks the output for obvious artifacts and iterates. A skilled attacker will regenerate multiple times, picking the best output, and may specifically test against known detection tools. Delivery — the deepfake reaches the target through the chosen channel: video call, WhatsApp voice message, social media post, direct email attachment.

Every stage of that pipeline has weak points, and every weak point becomes a detection signal. Voice clone from three seconds of audio has audible artifacts that voice clone from three hours doesn’t. Face swap trained on twenty single-angle photos fails at unusual head poses. Real-time video generation has temporal lag that pre-rendered video doesn’t have. These are not accidents — they’re the mathematical consequences of a pipeline running with limited resources. When you look for the tells on Days 2 through 4, you’re really looking for the fingerprints the pipeline leaves behind.

Time cost matters for defenders too. A basic voice clone attack can be assembled in a few hours by someone with no technical background. A high-quality face-swap video call attack like the Hong Kong fraud takes days to weeks. The barrier to entry keeps dropping. Tools that were research prototypes in 2022 are consumer apps in 2026. The gap between what’s technically possible and what’s practically available to attackers has closed dramatically.

Why Detection Is Getting Harder in 2026

I always show my students the same before-and-after: a 2020 deepfake next to a 2026 one. The difference is not just quality — it is the specific artifacts that used to give it away and no longer do.

A 2020-era deepfake was obvious. Blinking was wrong or absent entirely — early face-swap systems didn’t model eye closure well. Hairlines smeared visibly into backgrounds. Skin tones didn’t match between the face and the neck. Head poses beyond straight-frontal produced dramatic geometric failures. You could spot a 2020 deepfake in under a second if you knew what to look for. A trained analyst didn’t even need a checklist.

A 2023-era deepfake required trained inspection. Most of the obvious artifacts had been closed by model improvements. Blinking looked normal. Hairlines were much cleaner. Skin tones matched. You needed the 8-point checklist you’ll learn on Day 2 to catch them reliably.

A 2026-era deepfake, at the highest quality level, passes casual visual inspection by security professionals. This is not hyperbole and it’s not fear-mongering — it’s the honest state of the technology. Three things changed. First, diffusion models replaced early GANs for most creation, and diffusion produces dramatically higher-quality output. Second, the tools became consumer software. What required a GPU cluster and a PhD in 2020 runs on a gaming laptop in 2026 with a downloadable app. Third, social media provided abundance of training data. Every public YouTube video, podcast, and Instagram post fed the training datasets that make current voice clones and face swaps so convincing.

But detection has not stopped being possible. It has shifted. The obvious frame-level artifacts are mostly gone. What remains: temporal inconsistency across video frames (covered Day 3), physiological signals like the blood-flow colour changes in skin that AI cannot yet fake (also Day 3), metadata forensics that reveal what tool generated the file (Day 3 again), audio prosody tells that voice clones still get wrong (Day 4), and cryptographic content provenance via the C2PA standard (Day 6). The detection game in 2026 is a layered game — no single tool catches everything, but the combination catches most of what matters.

The Arms Race — Where Detection Stands Today

I want you to leave Day 1 with a realistic view of where we actually stand — neither the panicked headlines nor the reassurances from AI companies.

On the detection side: AI companies are building detection tools, sometimes because it’s the right thing to do and sometimes because regulation is starting to demand it. Adobe, Microsoft, Google, and camera manufacturers like Nikon, Sony, and Leica have adopted C2PA content credentials — a cryptographic standard that lets authentic content prove its authenticity rather than trying to detect the fake. The EU AI Act, which entered force in 2026, requires disclosure when AI has generated or significantly altered a human likeness in publicly distributed media. Journalism organisations have professional verification workflows built on tools like WeVerify and Hive Moderation.

On the creation side: creation tools improve faster than detection tools. Every new generation of image or video model is specifically trained against the previous generation’s detection signatures — an adversarial process that closes the artifact gaps. Consumer tools become more powerful every quarter. Real-time face and voice conversion, which barely worked in 2023, works well enough in 2026 to run entire fraudulent video calls.

The honest summary: current defenders can catch most current attackers most of the time, if the defenders know what to look for. That’s a real “if.” Most people don’t know what to look for. This course closes that specific gap for beginners in seven days.

The detection “win” in 2026 isn’t a single tool. It’s a layered approach: visual inspection using the checklists you’ll learn on Days 2 through 4, tool analysis using the free stack you’ll build on Day 6, provenance verification using C2PA when available, and — most importantly — behavioural verification using the out-of-band protocol you’ll write into your personal defence plan on Day 7. That full stack is what this course teaches. By the end of Day 7 you have all four layers.