How to Spot a Deepfake in Real Time — One Simple Trick That Actually Works

Most people assume they'd know if they were talking to a deepfake. They're wrong. Modern AI face-swapping technology has gotten good enough that a real-time deepfake on a video call can pass a casual look without raising flags. The lighting adjusts, the expressions track, the lip sync is close. If you're not actively looking for something off, you probably won't notice.

But deepfakes have a weakness — and it's one that's easy to exploit in the middle of a conversation.

The Three-Finger Test

Ethical hacker Jim Browning, known for his work exposing scam call centers, demonstrated the technique in a webinar with Huntress security researcher John Hammond. It's straightforward: during a video call, hold up three fingers directly in front of your face.

Not off to the side. In front of your face, between the camera and your face.

Deepfake technology works by generating a synthetic face and compositing it onto a video feed. What it struggles with is occlusion — objects that pass in front of the generated face. When something physically blocks part of the face in the real video, the deepfake engine has to figure out how to handle that, and it typically can't do it cleanly. The result is a visible glitch: fingers that disappear into the face, artifacts around the edges, a momentary break in the render.

A real person on a real video call has no such problem. Their fingers pass in front of their face exactly as you'd expect.

If the person on the other end hesitates, asks why you're doing that, or you see anything strange in how the image handles your request — that's worth paying attention to.

Why This Works

Current deepfake pipelines are optimized for faces. They're trained on face data, they track facial landmarks, and they composite the synthetic face onto the incoming video stream. The underlying model isn't built to understand depth or handle arbitrary occlusion from foreign objects in real time. It's a rendering limitation that persists even in high-quality systems.

It's similar to how early deepfakes struggled with blinking — the models weren't trained on enough blink data, so generated faces would stare unnaturally. Developers fixed that over time. Occlusion handling is harder because it requires understanding the spatial relationship between objects in the scene, not just face generation.

That said, this isn't a permanent fix. It's a limitation of current technology, not a fundamental one. As the models improve, this gap will narrow. But right now, in 2026, the three-finger test is a fast, low-effort way to verify you're talking to a real person.

Why This Matters Now

Deepfakes aren't just a celebrity-image problem or an abstract future concern. They're being used in active financial fraud. Browning and Hammond's webinar covered real scam operations — organizations running like legitimate businesses, with HR departments, training programs, and quality assurance — that are already using AI-generated identities to impersonate people on calls.

There have been documented cases of employees being deceived into transferring money after video calls with what they believed were executives at their company. The face looked right. The voice sounded right. The request felt urgent. And the money moved.

The technical barrier to running a convincing real-time deepfake has dropped significantly. You don't need specialized hardware or an expert. You need a laptop and the right software. That puts it within reach of fraud operations that are already running at scale.

Practical Habits Worth Developing

The three-finger test is the most actionable thing you can do mid-call, but it fits into a broader set of habits:

Verify through a second channel. If someone on a video call asks you to do something sensitive — transfer money, share credentials, approve access — confirm the request through a different channel before acting. Text the person directly. Call a known number. Don't assume the video call is sufficient verification.

Watch for resistance to verification. Scammers using deepfakes don't want you to think too hard. If someone pushes back on a simple verification step or creates urgency to bypass it, treat that as a signal.

Pay attention to audio-visual sync. High-quality deepfakes handle lip sync reasonably well, but it's not perfect. Slight delays, unnatural mouth movements, or audio that doesn't quite match the face are still common tells.

Look at the edges. Hair, ears, and the boundary between face and background are harder for deepfake models to handle cleanly. Flickering or blurring at those edges can indicate a synthetic face.

The Bigger Picture

Deepfake technology is improving faster than most people realize, and the people deploying it for fraud are not waiting for it to be perfect. They're using what's available now because it's good enough to fool enough people enough of the time.

The three-finger test isn't a silver bullet. It's a friction mechanism — a simple action that raises the cost of deceiving you by exploiting a current technical limitation. That's worth knowing.

The best defense against social engineering has always been skepticism and verification, not just technical detection. AI-generated faces are a new delivery mechanism for a scam that's as old as fraud itself: make someone trust you, then exploit that trust.

Final Thoughts

Jim Browning and John Hammond's work is a good reminder that understanding how attacks actually work is more useful than general awareness that attacks exist. The people running these operations are sophisticated. The tools they're using are accessible. And the targets are ordinary people who have no reason to suspect the person on their screen isn't real.

Hold up three fingers. See what happens. It takes two seconds and it might save you from something that costs a lot more.