Convincing Deepfakes

A familiar voice on the phone or a recognizable face on a video call used to offer some reassurance that you knew who you were dealing with. AI has changed that. Voice cloning, face swaps, and real-time video impersonation now allow scammers to convincingly pose as executives, job candidates, romantic interests, or even family members. Understanding how these attacks work and where they may be headed is a central part of Tom Cross's work as Head of Threat Research at GetReal Security.
Tom has spent more than 30 years studying cybersecurity threats, software vulnerabilities, and the methods attackers use to exploit technology. Before joining GetReal Security, he held leadership roles at IBM X-Force, Lancope, and Drawbridge Networks, and he has shared his research at major security conferences including Black Hat and DEF CON. His current work focuses on deepfake-enabled social engineering and the development of tools that can detect digital impersonation, including signs that are often too subtle for a person to recognize.
In this episode, we learn how little audio is needed to clone someone's voice, why live video is no longer reliable proof of identity, and how deepfakes are being used in romance scams, investment fraud, identity theft, and remote hiring schemes. We also talk about AI agents that can carry on persuasive conversations, adjust their behavior based on a victim's reactions, and repeat those tactics on a massive scale. The discussion offers a revealing look at why familiar advice for spotting fakes is quickly becoming outdated and what individuals and organizations will need to do differently as the technology improves.
Show Notes:

• [01:05] Tom shares how his early work in vulnerability research led to a career studying sophisticated cybersecurity threats.
• [03:32] Running a bulletin board system as a teenager helped spark an enduring interest in hacking and computer security.
• [06:11] A look back at early online communities, text-based games, Fidonet, and the pre-internet era.
• [09:36] The conversation shifts to deepfake research and the technology being developed to detect manipulated media.
• [11:29] Deepfakes are divided into audio, visual, file-based, and real-time forms, each creating different risks.
• [15:20] Modern voice clones can fool both people and biometric authentication systems, making specialized detection increasingly important.
• [18:30] Virtual backgrounds and other subtle processing artifacts may reveal manipulation even when nothing looks obviously wrong.
• [20:31] Deepfake detection has become another cybersecurity arms race as attackers continually improve their methods.
• [22:30] Romance scams, investment fraud, remote job schemes, and identity theft are among the growing uses of deepfake technology.
• [25:26] Scammers succeed by exploiting desires, expectations, and the human tendency to rationalize warning signs.
• [27:56] Large-scale phishing and business email compromise attacks only need a small…