Who is really there?

In early 2024, a finance employee at the engineering firm Arup joined a video call with what looked like several colleagues, including a senior executive. Every one of them was a deepfake. By the end of it, he had sent about 25 million US dollars to the fraudsters.¹ He had been suspicious of the original email; the live call with familiar faces convinced him.

What took a coordinated crew in 2024 is now cheap. A few seconds of recorded voice is enough to clone it, and live video can be faked on an ordinary laptop. Software packages and devices can be faked too.

Three ways to pass as someone you're not

1. Pretending to be a person. A cloned voice calls a grandparent late at night asking for urgent bail or medical money. A fake executive joins a video call to authorize a wire transfer. Or a bot poses as a customer, a voter, or a neighbour in a local consultation.

2. Tampering with software before it reaches you. In March 2024, an engineer discovered a hidden backdoor in XZ Utils, a piece of open-source software built into millions of servers. The person who planted it had spent roughly two years patiently contributing code and earning the volunteer maintainer's trust first.²

3. Tampering with hardware and sensors. Someone can physically alter a camera, utility meter, or thermometer so it reports whatever they want while keeping its digital seal intact. Think of a courier taping a small heater beside a thermometer inside a refrigerated medicine van. Counterfeit parts have turned up in some of the most carefully guarded supply chains in the world.

All three failures point to the same lesson. As we noted in Postmarks for the real world, a tampered camera signs a false picture just as faithfully as an honest camera signs a true one. A seal tells you where something came from. It doesn't tell you it's true.

Proving a person is there without handing over your life story

Before we look at how to catch sophisticated fakes, we have to avoid an obvious trap. When organisations panic about impersonation and bots, their first instinct is often to demand intrusive identity checks from everyone. They ask people to upload a government passport scan, submit a live facial biometric video, or hand over a home address just to join a forum.

Turning the internet into a permanent border checkpoint would be a disaster for privacy and free speech. Worse, centralising millions of passport scans creates a honeypot for the very fraudsters we want to stop.

Fortunately, we don't need to strip away privacy to know that a real person is on the other end. Selective-disclosure credentials let us verify the exact fact that matters for a conversation without exposing everything else.³

Think of two familiar scenes from everyday life:

• The bouncer at the door. When you walk into a venue that serves alcohol, the bouncer needs to know one narrow fact: are you over 19? You shouldn't have to let them photocopy your home address, medical history, or bank balance. A selective-disclosure credential shows a tamper-proof "Yes, over 19" without letting the venue copy your personal records.
• The town hall hand stamp. Imagine arriving at a municipal town hall meeting. At the entrance table, a volunteer checks the voter roll once to confirm you live in the district, then stamps the back of your hand. Inside the hall, that stamp proves you are a real resident rather than a paid impersonator, without forcing you to wear a badge listing your street address.

Digital personhood credentials work just like that town hall hand stamp. They let a community forum verify that each account belongs to a distinct human being. They also let your workplace assistant confirm a colleague's active badge, while leaving zero trail of personal documents behind.

No single clue is enough

Even with good credentials, a stolen device or a tricked sensor can still pass a single gate. So how do you spot a fake? The same way a good detective does: you combine several independent clues that each tell part of the story.

• Does the story of where it came from hold together? Who made the device, how did it arrive, and can you trace its software back to an audited source?
• Has anyone found a problem with this source before? Public, dated lists of bad batches, revoked keys, and broken channels help everyone check.
• Does it break the laws of physics or common sense? A meter reporting use during a power cut. A photo whose shadows don't match the time of day. A colleague joining a call from London ten minutes after badging into an office lift in Toronto.
• Do independent witnesses agree? Air-quality monitors or thermometers from different makers, owned by different neighbours, should roughly agree. When one device drifts far from the rest, that mismatch is worth a look.
• Does the behaviour fit? When a familiar account suddenly demands secrecy, skips normal sign-off steps, and asks to route money to a new account, someone else may have taken the wheel.

AI agents are well suited to this kind of patient cross-checking, if they are trained for it. That means practising first in simulated worlds full of honest and dishonest participants, where the right answer is known. Assistants should be rewarded for catching real spoofing and penalised heavily for false alarms.

Walkthrough: how your assistant catches the fake call

Go back for a moment to the finance worker on that deepfake video call. Imagine how differently the afternoon unfolds when his personal assistant cross-checks those five clues in the background.

The faces and voices on screen look convincing to human eyes. Underneath the surface, however, the clues refuse to line up. The meeting link came from an outside domain, the video stream carries no hardware postmark from company laptops, and the chief financial officer's real calendar shows she is boarding a flight offline.

Instead of locking the worker's computer, his assistant shows a calm banner at the top of the screen. It notes that the video stream is unsigned and offers to send a one-tap check to the CFO's verified phone number before any transfer leaves the bank.

One check over a second, independent channel breaks the illusion in thirty seconds.

The same five-clue check works just as well for physical devices. Suppose a community clinic receives a shipment of childhood vaccines that must stay cold during transit. The delivery van's built-in sensor reports a steady four degrees all morning.

Instead of trusting that single thermometer blindly, the clinic's assistant checks the delivery against two other clues. It compares the van's route against a municipal traffic delay in the afternoon heat, and checks an inexpensive, independent indicator strip packed inside the cooler box itself. When the two witnesses disagree, the nurse knows to inspect the vials before administering a single dose.

An alarm should start a fair check

This is the part that matters most. In daily life, most alarms have innocent explanations: a cheap sensor, a rural connection that drops packets, or a relative calling from a borrowed hospital phone. A system that treats every alarm as guilt would hurt the people least able to afford the newest equipment.

So the steps should always be gentle and fair:

1. Give the suspect evidence less weight, or pause the high-stakes transfer, without judging the person behind it.
2. Tell the person privately, and explain plainly why the check triggered.
3. Ask for an independent check, such as a callback on a saved number, a family code word, or a second device.
4. Report tampering only after you confirm it and can show the evidence.
5. Give anyone flagged a clear way to appeal, and restore their standing fully once cleared.

Where this leaves you

For now, the best defence is an old-fashioned one. If a call or message asks for money or access and something feels off, check through a different channel you already trust. Call back on a number you know. Ask a question only the real person could answer.

In time, we hope personal assistants will handle that cross-checking and fairly in the background, working alongside the action receipts we describe in Who is actually acting? The goal is to let you answer a call or read a message knowing the person on the other end is really there, without treating everyone as a suspect.

1. Hong Kong police first reported the 200 million Hong Kong dollar (about 25.6 million US dollar) deepfake video-call fraud in February 2024, and Arup confirmed in May 2024 that its Hong Kong office was the target. See Heather Chen and Kathleen Magramo, "Finance worker pays out $25 million after video call with deepfake 'chief financial officer,'" CNN (Feb. 4, 2024); Kathleen Magramo, "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee," CNN Business (May 16, 2024); and Dan Milmo, "UK engineering firm Arup falls victim to £20m deepfake scam," The Guardian (May 17, 2024).

2. The XZ Utils supply-chain backdoor (versions 5.6.0 and 5.6.1), planted by an account using the name "Jia Tan" after roughly two years of trust-building and discovered by Microsoft engineer Andres Freund on March 29, 2024. See Andres Freund, "backdoor in upstream xz/liblzma leading to ssh server compromise," Openwall oss-security (Mar. 29, 2024), and CVE-2024-3094 in the NIST National Vulnerability Database.

3. Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly, NIST Special Publication 800-207: Zero Trust Architecture (August 2020); World Wide Web Consortium (W3C), Verifiable Credentials Data Model v2.0 (May 2025).

4. On the vulnerability of dynamic remote context dereferencing and recursive graph canonicalization (RDFC-1.0) to denial-of-service poison graphs, context injection, and SSRF in verifiable credential pipelines—and the architectural resilience of self-contained formats like SD-JWT VC—see Naohiro Fujie and Shigeya Suzuki, "A Security Analysis of Verifiable Credential Verification Pipelines: Attack Surface Arising from JSON-LD/RDFC Canonicalization Compared with SD-JWT VC and mdoc," arXiv:2611.04461 (Nov. 2026), and Daniel Fett, Kristina Yasuda, and Brian Campbell, "Selective Disclosure for JSON Web Tokens (SD-JWT)," IETF OAuth Working Group RFC 9901 (2026).

5. Shaina Raza, "The Deepfakes We Missed: We Built Detectors for a Threat That Didn't Arrive," arXiv:2605.12075 (May 2026), documenting how 2022–2026 empirical harm distributions shifted to family voice clone extortion and employee impersonation.