The fake you were trained to spot is gone.

The clearest evidence comes from two listening studies published in 2026.

The largest study yet. Müller and Choong collected 35,532 judgements from 1,768 people across 138 speech synthesis systems.¹Clips from older system designs were identified correctly about 75% to 77% of the time. Clips from current commercial and language-model-based systems were identified only 61% to 66% of the time, not far above guessing. Compared with a 2021 baseline, people were no better at catching fakes (72.9% then, 71.2% now). What changed was their trust in real voices: accuracy on genuine recordings fell from 72.7% to 64.1%. The authors conclude that the main threat "may not be mere deception, but the erosion of trust in genuine audio".

Even IT professionals. Šalko and colleagues tested 82 IT professionals, a group that should do better than the public.²Against older open-source synthesisers, their F1 score (a combined measure of catching fakes and not flagging real speech) was about 90%. Against ElevenLabs, a widely available commercial tool, it fell to 48%. When a single synthetic sentence was spliced into otherwise real speech, strict accuracy fell to 9%, and the fake sentence was judged genuine 77% of the time. Their conclusion: "human perception alone is unreliable" for modern and partial-spoof conditions.

The tools that make these voices are now ordinary. In a peer-reviewed study published in PLOS One in September 2025, clones made with a consumer product from about four minutes of recordings were judged human 58% of the time; real voices in the same experiment were judged human only 62% of the time.³When Consumer Reports tested six voice-cloning products in March 2025, four required only that the user "check a box" confirming they had the right to clone the voice.⁴

Can training close the gap? Not reliably. A 2025 systematic review of 40 studies found interventions to improve deepfake detection "yielded mixed results".⁵In one of the better results, five minutes of training raised typical people's accuracy at spotting AI-generated faces from 31% to 51%, still close to a coin flip, and that was for still images rather than live video.⁶

If people cannot hear the difference, perhaps software can. In the lab, it often does: the detector baseline in the Müller and Choong study scored above 94.5% on that study's own clips.¹ In the wild, the picture is very different.

Deepfake-Eval-2024, a benchmark built from deepfakes actually circulating online in 2024 (45 hours of video, 56.5 hours of audio and 1,975 images from 88 websites in 52 languages), found that the performance of leading open-source detectors "drops precipitously" on real-world material.⁷Commercial models did better, but "do not yet reach the accuracy of deepfake forensic analysts". A March 2026 study of 200 people against 95 detectors found that on everyday phone-recorded video, the detectors' accuracy "collapses to near chance (0.537) while humans maintain robust performance (0.784)", but that people missed the high-quality fakes.⁸A third team found that every detector they tested struggled with real political deepfakes and was "vulnerable to simple manipulations".⁹

Detectors built for live calls are an active research area; one 2025 system that tracks where a speaker is looking reached 82% accuracy on its authors' own test set.³⁴ That is promising, and not yet a field result.

The incidents reported since January 2025 share a shape that earlier cases did not. The deepfake rarely works alone. It is one step in a sequence across several channels, and its job is usually to confirm a story that started somewhere else.

Other reported cases follow the same logic. In July 2026, Indian software company Capillary Technologies told the stock exchange that a recently acquired subsidiary had lost about €3 million to "advanced deepfake methods including cloning, signature forging, social engineering to impersonate the company's senior management". ¹⁴Throughout 2025, the FBI warned twice that senior US officials were being impersonated with AI-generated voice messages that "closely match the cadence, tone, and accent of real officials", followed by a request to move to an encrypted messaging app.^15,16The voices of Italy's defence minister and the US Secretary of State were both imitated in 2025.^17,18And in July 2026, eleven governments warned that North Korean IT workers applying for remote jobs present "video feeds that appear to be manipulated or artificially generated".¹⁹

Inside organisations, this is no longer rare. In a Gartner survey of 302 security leaders published in September 2025, 62% said their organisation had faced a deepfake attack in the previous twelve months, 44% on an audio call and 36% on a video call.²⁰

Regional data points the same way. Singapore's police recorded 3,363 cases of government-official impersonation in 2025, with losses of S$242.9 million, and noted that impersonation of senior executives sometimes uses "digital manipulation techniques ... including via Zoom meetings". ³⁰And in the World Economic Forum's 2026 survey of 804 leaders, chief executives ranked cyber-enabled fraud as their top concern, ahead of ransomware.³²

Here the honest picture is more interesting than the headlines. The FBI's 2025 Internet Crime Report is the first to count complaints that mention AI: 22,364 of them, with losses above $893 million.²¹ Yet of $3.05 billion lost to business email compromise in 2025, only about $30 million came from cases where the victim reported AI involvement. That is about 1%.

Two things are true at once. First, these figures depend on victims realising AI was involved; the FBI itself says "many victims do not realize the extent AI may be involved in scams", and it warned in December 2025 that "AI-generated content has advanced to the point that it is often difficult to identify".^16,21 The counted share is a floor, not a measure. Second, no reliable dataset yet shows deepfakes driving a measured surge in business payment losses. Anyone who tells you otherwise with a precise percentage is guessing.

The most rigorous work on AI-written attacks points to the same conclusion. In a peer-reviewed study published in June 2026, spear phishing written entirely by an AI model drew a 54% click rate, identical to emails written by human experts and far above the 12% control.²²AI did not out-persuade the experts. It matched them, at what the authors estimate is up to 50 times the profitability for large campaigns. A companion study of AI voice phishing with 4,100 participants found that the main risk lies in "the economics of automation rather than novel or 'superhuman' persuasive techniques". ²³

Official forecasts agree. The UK's National Cyber Security Centre expects AI to raise "the volume and impact of cyber intrusions through evolution and enhancement of existing TTPs, rather than creating novel threat vectors", and judges fully automated end-to-end attacks "unlikely to 2027". ²⁴Europol's 2026 assessment warns that criminal use of agentic AI "is set to raise the threat from OFS [online fraud schemes] to unprecedented levels", while describing it today as "a developing driver for crime". ²⁵Verizon's 2026 report adds a useful check: in its incident data, the share of breaches starting with phishing "has barely moved", though it notes it cannot measure fraud against individuals.²⁶

There is good news in the 2025 data, and it points in one direction. UK Finance reported that CEO fraud fell 53% in 2025 to £5.6 million, its lowest case count ever, and that invoice and mandate fraud fell to its lowest loss total on record.²⁷UK Finance credits "continued industry investment in fraud prevention and customer education and awareness", and notes that checks such as confirmation of payee may help catch these payments earlier. This happened while cloning tools spread. It is correlation, not proof, but it is the strongest real-world signal we have, and it is a signal about process.

The FBI's data tells the same story about speed. Through its Financial Fraud Kill Chain in 2025, quick reporting froze $679 million of $1.16 billion in attempted theft, 58%.²¹And the most specific official guidance anywhere, published by the Monetary Authority of Singapore in September 2025, is almost entirely procedural: verify through "a separate and trusted communication channel", use "code words" for high-risk requests, enforce dual control so no single person can move money "the minute he or she falls prey to a deepfake impersonation attack", and "conduct regular video and voice deepfake simulation exercises on employees".²⁸

Forecasting is where most writing on deepfakes goes wrong, so we have kept to claims the 2025 and 2026 evidence can carry.