How deepfake scams work, and the exact steps to fight back

According to ESET, generative AI has made it fast, cheap and easy to build a fake video or image of a real person. That capability is now showing up in scams, extortion attempts and harassment campaigns, and the person targeted is often the last to find out.

The mechanism starts with the same source material everyone already has online: photos, video clips, a voice recording. A fraudster feeds that material into a GenAI tool. What comes out is a realistic-looking video or image of someone doing or saying something they never did. From there it gets used for fraud, blackmail, defamation, harassment or impersonation.

The step the scam depends on

The scam depends on the target either believing the fake is real, or fearing that other people will. A deepfake used for extortion works only if the victim is too embarrassed, frightened or confused to question it before acting. A deepfake used for fraud, such as a fabricated video impersonating someone in authority, works only if the person receiving it treats the video as proof rather than as content that can be manufactured in minutes.

Children are frequently targeted, and ESET notes that some victims have taken their own lives as a result. That is the extreme end of what happens when the shame of a fake image outpaces someone's ability to get it removed.

What the law does and does not cover

Whether a deepfake is illegal depends on what kind it is. In the US, the TAKE IT DOWN Act criminalizes distribution of non-consensual intimate imagery, and platforms must now provide a reporting mechanism and remove legitimately reported images within 48 hours. The UK's Data Act and Online Safety Act make creating that kind of imagery a criminal offense, with the same 48-hour removal window. The EU AI Act will soon ban systems built specifically to create that imagery, though individual conduct is still governed by each member state's own laws. If the image involves a child, it is illegal in most jurisdictions regardless of any of this.

Outside of intimate imagery, the legality turns on intent and consent. A deepfake made and shared without consent, for fraud, blackmail, defamation, harassment or impersonation, can be illegal even where no specific deepfake law exists.

What to do if it happens

The first move is to preserve evidence before doing anything else: screenshot the page or account, save the URL, and note the account or username, the date and time it was found, and any text posted alongside it. Do not contact the person who posted it; engaging can prompt them to spread the content further instead of stopping.

Most platforms now have a reporting path for deepfakes, but there is rarely a single button marked for it. The report has to be filed under whatever the deepfake enabled, such as bullying or fraud, and that framing has to be explained in the report itself. Anyone who feels physically threatened should report that to the police directly, separate from any platform report.