Synthetic Media, Deepfakes, and Digital Trust
An evidence-based account of what fails, what holds, and how each claim can be checked
Documented incidents
| Case | When | What happened | What decided it | Evidence |
|---|---|---|---|---|
| UK energy firm | March 2019 | €220,000 transferred after a cloned-voice call | One channel both initiated and authorised | C3.02 |
| Slovakia election audio | September 2023 | Synthetic audio two days before the vote | Published inside a 48-hour moratorium, so rebuttal was constrained | C2.01 |
| Retool | August 2023 | 27 customer accounts compromised | Cloud-synced one-time codes collapsed two factors into one | C3.03 |
| New Hampshire robocall | January 2024 | Cloned-voice calls urging voters to stay home | $6m fine and 26 counts, reported uncollected | C2.03 |
| Arup, Hong Kong | early 2024 | HK$200m in 15 transfers after a synthetic video call | A video call accepted as sufficient authorisation | C1.01 |
| LastPass | April 2024 | Cloned-voice messages impersonating the chief executive. No loss | Channel was off-policy and the employee reported it | C3.04 |
| WPP | May 2024 | Voice clone and video footage in a meeting. No loss | The request itself was anomalous | C3.05 |
| Ferrari | July 2024 | Cloned-voice call impersonating the chief executive. No loss | One out-of-band question with an unpublished answer | C3.01 |
| FBI advisory I-051525-PSA | May 2025 | Campaign impersonating senior officials and their contacts | Advisory recommends verifying by calling a known number | C9.01 |
Full accounts are in Chapter 3 for the fraud cases, Chapter 2 for the election cases, and Chapter 9 for the FBI advisory. Each identifier resolves to the evidence ledger, which records the source and what it does not establish.
Research results used as case studies
| Result | What it established | Evidence |
|---|---|---|
| Deepfake Detection Challenge | Best public score 82.56% average precision; best black-box 65.18%, by a model ranked fourth on the public set | C4.02 |
| Spectral up-convolution | A signal supporting up to 100% benchmark accuracy, published alongside the regularisation that removes it | C6.01 |
| Five attacks on one classifier | 0.95 AUC driven to 0.0005 white-box and 0.22 black-box | C7.01 |
| GPT detectors and non-native writers | 61.22% false positives against roughly 5% for native writers | C8.02 |
The pattern
Three of the corporate incidents ended in loss and three did not. The three losses share one property: a single channel was permitted both to make a request and to satisfy its authorisation. The three failures were stopped by a question whose answer was not published, by a messaging channel being outside policy, and by a request that did not fit. Detection appears in none of the six.