One of the things we’re asked the most about at GetReal Security is how to reliably tell if a deepfake attack is occurring. 

If you’re only relying on human perception — what you see and hear — the answer is: you can’t. Generative AI alongside increasingly sophisticated criminal behaviors, often state sponsored by North Korean operatives, has made it impossible for humans to use perception alone to detect these attacks.

Digital identity is the new vector, and for enterprises these attacks create an urgent threat to their ability to do business.

The solution is to embed detection technology and security processes along the entire workforce perimeter.

Here are five deepfake tells that aren't reliable anymore:

The Tell: Wave a hand in front of the face.

The Background: Early and lower-quality face-swap tools would blur, shimmer, or break when the face was occluded. 

Why It’s Unreliable: Face-swap technology passed this threshold over a year ago. With a $9 subscription and a simple camera injection running on a consumer gaming laptop, occlusion-aware deepfakes can be perpetrated. This technology continues to improve at a rapid pace and will only get better.

The Tell: The lips are out of sync with the voice.

The Background: Many face-swap tools cause a slight delay between voice and video due to processing.

Why It’s Unreliable: Delays can easily be adjusted via settings, and there are several other reasons why video may appear out of sync with audio, such as quality of connection.

The Tell: Listening for accents.

The Background: North Korean operatives are running widespread fraudulent remote-hiring schemes.

Why It’s Unreliable: Only experts can accurately detect the origin of specific accents, and voice changers are already on the market that can alter an accent convincingly. Additionally, there’s growing evidence that DPRK agents are expanding their use of proxies to help disguise their origins.

The Tell: Ask the operator to say something negative about the DPRK regime.

The Background: Videos have circulated showing alleged North Korean operatives unwilling to say something negative about the regime.

Why It’s Unreliable: At any time operatives may be granted permission to speak certain phrases, proxies will be willing to say them, and LLMs will say what their operators tell them to.

The Tell: Ask the other person to hold up their ID to the camera.

The Background: Identity proofing — having someone show a government ID and take a selfie to match — is the most common verification step in remote hiring and onboarding.

Why It's Unreliable: Deepfakes already defeat these checks. Attackers use AI-generated faces that match forged IDs, and injection attacks feed synthetic video directly into the verification tool, bypassing the camera entirely. A document that looks valid and a face that matches it are no longer proof the person is real or who they claim to be.

None of these tells work anymore, and the next one won't either. These tools are made to deceive human perception, and the technology used to perpetrate these attacks improves on a monthly basis. Human eyes and ears are not a reliable safety net.

Embedding detection technology and verification into your workflows, continuously, across every channel where trust is established, is an essential part of the defense.