Cybersecurity, Deepfakes, Phishing

How to spot a deepfake [Real Examples]: 10 Visual and Audio Signs Everyone Should Know in 2026

Table of Contents

96% of deepfakes online are used maliciously. They’re being used to impersonate CEOs, pressure employees into urgent actions and manipulate financial transactions, all with AI-generated videos or voice notes that feel shockingly real.

In our recent CloudGuard webinar “The Art of Deception: Fight Back Against the Fakes,” our analysts broke down the exact visual and audio cues that give deepfakes away. While attackers are getting faster and more sophisticated, the technology still struggles with certain human subtleties.

This guide explains the most reliable signs of a deepfake, based directly on the examples we demonstrated during the session.

Prefer a quick visual walkthrough?


We’ve created a step-by-step interactive demo that shows some of the most common visual signs of a deepfake.

It’s a fast way to understand what to look for, but it doesn’t cover every sign or the deeper audio and behavioural cues explained below. For the full picture, we recommend reading the complete guide.

👉 Share it with colleagues as a quick awareness resource: https://app.storylane.io/share/qas6epugt1ul

1. Teeth that change shape or look “too perfect”

Teeth are one of the hardest facial features for AI to replicate.

Watch out for:

  • Teeth morphing during speech
  • Sharp or inconsistent edges
  • Teeth that look unnaturally aligned or glossy

In the webinar’s deepfake of our CEO, the teeth subtly changed shape mid-sentence, a clear giveaway.

2. Unnatural blinking or eye flickering

Humans don’t blink at regular intervals, AI often does.

Red flags include:

  • Rapid or mechanical blinking

  • Long periods without blinking

  • Eyes that don’t track naturally

  • Flickering behind glasses

Even through eyewear, the deepfake we showcased had eye movements that simply “felt off.”

3. Facial marks that appear or disappear

Moles, freckles, shadows and facial lines should stay consistent.

Deepfake models often struggle with:

  • Marks vanishing frame to frame

  • New marks appearing randomly

  • Shifting shadows that don’t match lighting

In our example, a beauty mark popped in and out across the video, something no real face does.

4. Lip movements that don’t sync perfectly

Lip-syncing is still one of the biggest technical challenges for deepfake models.

Look out for:

  • Lip edges that flicker or blur

  • Mismatched timing between audio and movement

  • Corners of the mouth that warp during speech

The deepfake of Matt showed subtle lip-edge distortion that betrayed the generated footage.

5. Clothing or hair that warps

Attackers focus on the face, the AI struggles with everything else in frame.

Signs include:

  • Buttons that disappear

  • Collars that bend unnaturally

  • Clothing merging with skin

  • Hair that blurs into the background

In the webinar demo, a shirt button simply vanished from one frame to the next.

6. A “filter-like” smoothness over the face

Deepfakes often look like a beauty filter has been applied:

  • Skin appears flat or overly smooth

  • Fine details (pores, wrinkles, texture) are missing

  • Lighting looks too even

The entire deepfake in our demo had a subtle blur overlay, which at first glance, can be very difficult to spot.

7. Audio pauses or rhythm that doesn’t match the speaker

Deepfake audio can be highly convincing, but speech cadence often gives it away.

Watch out for:

  • Pauses in unnatural places

  • Rhythms that don’t match how the person normally speaks

  • Odd “emphasis” on random words

Our analysts highlighted that the deepfake inserted pauses in a way that completely changed the tone, something anyone who knows the speaker would find suspicious.

8. Hollow, tinny or overly “polished” audio

Beyond speech patterns, sound quality itself can be a giveaway:

  • Lack of background noise

  • Robotic undertones

  • Reverb or echo that doesn’t match the environment

Even professional-grade deepfakes struggle to replicate the imperfections of real audio.

9. Inability to handle unexpected questions

A powerful real-world technique: Ask something off-topic.

AI can’t improvise naturally, especially in real time. In the webinar, we showed an example of an unscripted question which was injected (“What’s your favourite chocolate?”).

As you can see, Mena is confused as to why the question is being asked, If it was deepfake, it wouldn’t have responded convincingly.

Humans show confusion, expression, hesitation, deepfakes don’t.

10. “Gut feeling” when something just feels off

This was one of the most common reactions in our live session. Your intuition matters.

Even if you can’t articulate why:

  • The tone feels wrong

  • The behaviour seems out of character

  • The message feels too urgent or unusual

Trust your instinct and verify.

Deepfakes are getting better, but so are detection techniques

As we demonstrated during the webinar, AI detection tools can analyse micro-patterns imperceptible to humans, although their accuracy varies depending on model sophistication. Some tools flagged our sample audio immediately as fake, others misclassified it entirely.

Because of this inconsistency, organisations need:

âś” Human awareness
âś” Technology-backed detection
âś” Verification processes
âś” A zero-trust communication culture

Deepfake attacks are growing, but they are not unstoppable.

Want to train your team to spot deepfakes?

CloudGuard runs live deepfake simulations to help businesses detect impersonation attempts before they become costly incidents.

👉 Book a tabletop exercise with our experts where we can do a deepfake simulation for your organisation. Would your team pass the test?

Author: Jonathan Hartdegen
Share:
Author: Jonathan Hartdegen
Share:

Related Resources

Dark purple background with claude logo and words pro, team and enterprise.
Claude Business Security: Choosing the Right Account for SMBs
When I shared my last article, a few people got in touch asking for a more practical follow-up, specifically around how small teams can use Claude Pro without putting business data at risk. This piece goes step by step through exactly that. Understand what you’re actually adopting Claude Pro is...
Two analysts looking surprised. Purple cyber background with phishing hook.
What Happens After a Phishing Attack? A Real Microsoft 365 Incident Walkthrough
If your organisation thinks a password reset or MFA alone are enough, think again. In this phishing attack breakdown by CloudGuard’s SOC team, Conor and Jon reveal the reality behind an actual breach involving a UK law firm, exposing how hackers use four methods to regain access long after initial...
purple background with computer that says threat from the field in cartoon like design
Cyber Threat Trends Q1 2026: Data Theft, AI Attacks and Emerging Risks
Executive Summary Every 90 days, we review the latest cyber threat trends to identify what IT leaders should learn, where resilience gaps are widening, and what practical actions organisations should take next.  The first quarter of 2026 has been intense. The UK threat picture is not defined by one single...
Microsoft Defender for Cloud
Microsoft Defender for Cloud Cloud environments change fast. New workloads, new services and new risks appear daily, often without full visibility or clear ownership. Microsoft Defender for Cloud provides continuous assessment across Azure, hybrid and multi-cloud environments to help organisations understand and reduce cloud security risk. CloudGuard ensures your cloud...
Woman looking at tablet with cyber imagery across the top.
The Limitations of External Penetration Testing (And What to Do About Them)
Core argument  Traditional internal penetration tests gives executives false confidence because it’s typically scope-limited, scheduled, doesn’t reflect real attacker behaviour and ignores the AI threats with user access. Would you feel comfortable boarding a plane if the pilot had practised emergency landings but had never actually simulated an engine failure?  So, why do businesses specifically exclude their...
CloudGuard logo and Stonewater Housing logo on a pastel purple background
Stonewater Housing Achieves 24/7 Security Monitoring Without Expanding Its IT Team
Image of man with half blue face on left and half red face on right. ÂŁ20 notes falling in the background.
Date | Time: 24/03/2026 | 12:00 pm
[On Demand] The AI-Enabled Insider Threat: When Trusted Access Becomes Competitive Advantage
Your most trusted employees can now distil years of institutional knowledge in days, sometimes without realising the risk they’re creating. Insider risk has fundamentally changed. We’re past the days of someone copying files onto a USB stick. Today, trusted employees are using AI tools to summarise reports, analyse strategy documents,...
Continuous Security Validation: How to Prove Your Cybersecurity Controls Actually Work
Core argument CISOs are increasingly measured not by the security they implement, but by the breaches they fail to prevent. Most cybersecurity investments create a false sense of protection because they’re never truly tested under realistic conditions.  Zero trust applied new controls but the new wave of Agentic AI solutions will fundamentally...
Date | Time: 10/12/2025 | 12:00 pm
The Art of Deception: Real vs AI – The Face Off [On Demand]
From reconnaissance to execution, modern adversaries can now generate convincing identities, clone leaders’ voices, imitate employees on video calls with precision. Using open-source tools and AI models available on platforms like Hugging Face and GitHub, creating weaponised deepfakes is accessible to anyone with basic skills. In this live session, our...
Get In Touch

Our Cybersecurity Services Can Instantly Improve Your Business’ Security Posture

Complete the form to find out more about any of our one-off or managed cybersecurity services. Not seeing what you’re looking for? Our cybersecurity consultants and MXDR experts are always on-hand to provide the guidance and support you need.