Enthec

Deepfakes: what they are and how to detect them

Deepfakes are among the most disruptive phenomena artificial intelligence has generated in recent years. Understanding what a deepfake is, how it works, and how to detect it is no longer a technical matter reserved for experts; it's a digital survival skill for anyone or any company operating in connected environments.

In this guide, updated to 2026, you will find the complete definition of deepfake meaning, the types that exist, real deepfake examples, and the most effective tools to detect them before they cause harm.

 

What are deepfakes?

The term "deepfake" comes from combining two words: "deep learning" and "fake." It refers to media content manipulated using artificial intelligence algorithms, specifically deep neural networks, to create a highly realistic version of something that didn't happen.
In other words, deepfakes let you change faces, voices, or even movements in videos and audio, making it seem like someone said or did something that never happened. For example, you might see a celebrity singing a song they never performed or a politician giving a fake speech.

 

 

How do deepfakes work?

Deepfake AI is generated using advanced deep learning technologies. This involves training the AI with large amounts of data, such as images, videos, and audio of a person so that the machine learns to replicate their gestures, tone of voice, and facial expressions.
This process uses techniques such as GANs (Generative Adversarial Networks), which pit two neural networks against each other: one generates fake content, and the other evaluates its authenticity, improving the result with each iteration.
Thanks to tools available online, creating fake images has become easier. In the past, creating a deepfake required advanced programming skills and expensive equipment, but today, anyone with access to certain applications can generate a manipulated video.

 

How does deepfake AI work?

Deepfake AI is based on two main technologies that work in parallel:

GANs: Generative Adversarial Networks

The most widespread mechanism for creating deepfakes is the generative adversarial network (GAN). These work by pitting two neural networks against each other; one generates the fake content, and the other evaluates it until the result passes detection. Each iteration improves the quality of the deception.

Diffusion Models: the new generation

Since 2023, diffusion models (such as those powering Stable Diffusion or Midjourney) have partially replaced GANs in generating still images. They are more stable during training and produce higher-resolution results. In 2025-2026, multimodal models like Sora (OpenAI) or VideoPoet (Google) brought this technology to full-video synthesis.

How much data does a deepfake need to function?

In 2020, creating a convincing deepfake required between 50,000 and 100,000 images of the target person. By 2026, the latest models can generate a believable animated video from a single high-resolution photograph. This has democratized the process and exponentially increased the risk.

 

Why are deepfakes dangerous?

Now that you know what deepfakes are and how they work, we must emphasize that although this technology has positive applications, such as in entertainment, education, or marketing, its dark side is undeniable. Deepfakes have been used to spread fake news, impersonate identities, and even extort people.

Impact on society

• Spreading disinformation. Deepfakes have become perfect tools for disinformation campaigns. Manipulating a video to make someone believe something false can have serious consequences, especially during elections or social crises.
• Reputational damage. A fake image or video can ruin the reputation of a public figure or anyone, affecting their personal and professional life.
• Cyberbullying and fraud. Deepfakes have been used to create non-consensual content or to trick people into fraudulent activities.

Critical threats from deepfakes

The risk of deepfakes is not only technological; it is also economic, reputational, and social. These are the most critical threats identified in 2026:

Financial fraud and Business Email Compromise (BEC)

Audio and video deepfakes have become the most sophisticated attack vector in next-generation BEC fraud. An attacker can clone the CEO's voice or simulate a corporate video call to authorize fraudulent transfers. The FBI and Europol report that this type of fraud grew by 200% between 2023 and 2025, though exact figures vary by source.

Disinformation and reputational damage

A deepfake can destroy a person's or company's reputation in minutes. Content can go viral before it can be debunked. For companies, deepfake-driven reputational damage can be equivalent to months of public relations work.

Identity theft in authentication

Facial verification systems used in banking, insurance, or access to corporate platforms are vulnerable to high-quality deepfakes.

Impact on people's safety

On an individual level, deepfakes are used for cyberbullying, sex extortion, and identity theft. Platforms such as Qondar allow citizens to monitor whether their image or digital identity is being used without consent.

 

 

 

 

The 6 steps to detect a deepfake

Although they are becoming more and more realistic, deepfakes are not infallible. A few tricks can help you spot these fake images and protect yourself from deception.

1. Notice the details of the face: Deepfakes often fail in subtle aspects, such as eye blinking, lip-syncing, or natural eyebrow movement. If a video seems strange, pay attention to these details.
2. Analyze the audio: In manipulated audio, the intonation and rhythm of speech can sound mechanical or unnatural. Listen carefully if something doesn't fit.
3. Look for lighting inconsistencies: Errors in shadows or reflections are common in deepfakes. It is likely false if the face's lighting does not match the environment.
4. Use specialized tools: Currently, platforms are designed to analyze whether a video or image has been manipulated. Cybersecurity tools such as Deepware Scanner or InVID can help verify content authenticity.
5. Trust official sources: Verify the information with reliable sources before believing dubious content. In many cases, deepfakes are designed to manipulate you emotionally and provoke immediate reactions.
6. Use specialized detection tools. AI-based deepfake detectors analyze the digital fingerprints left by generative models. These tools fall under what cybersecurity companies call next-generation cybersecurity tools designed to detect synthetic content.

What to do if you find a deepfake?

If you suspect you have encountered a deepfake or that you are a victim of one, take the following steps:

• Don't share it: Spreading false content, even with the intention of denouncing it, amplifies its reach.
• Document the evidence: Download the content, save the URL, and note the date and context before it is deleted.
• Report on the platform: All major social media platforms have reporting mechanisms for manipulated, synthetic content. Use them.
• Notify the affected person: If the deepfake impersonates a known person, inform that person directly so they can take legal action.
• Contact INCIBE or your national Cybersecurity Agency: Spain's National Cybersecurity Institute and all the National Cybersecurity Agencies offer assistance to citizens and companies affected by digital security incidents, including deepfakes.

In the business context, deepfakes are an attack vector that must be considered in email security and identity-verification strategies.

 

Deepfake AI and regulation in 2026: what changes

The European Union's AI Act, in force since August 2026, establishes specific obligations for providers of generative AI systems. Among them is the obligation to label synthetic content with detectable digital watermarks. This measure, although relevant, does not solve the problem of deepfakes created with tools outside of European regulatory control.

In Spain, the GDPR and the Organic Law on Data Protection already allow individuals to file complaints with the Spanish Data Protection Agency (AEPD) regarding the non-consensual use of their image through deepfakes. However, attributing deepfakes to a specific author remains the main legal challenge in 2026.

The convergence of deepfakes with other threats such as SIM swapping, ransomware, and AI in cybersecurity is creating increasingly complex attack scenarios that require coordinated responses.

How can we help you at Enthec?

At Enthec, we know the challenges deepfakes pose to individuals. We provide cyber surveillance solutions that help people detect and prevent digital manipulation.
The impact of deepfakes is real, but with the right solutions, you can stay one step ahead. Contact us and protect what matters most: your credibility and security.
In a world where making someone believe something false is true has become so simple, prevention and knowledge are your best allies. Don't let deepfakes fool you: identify, protect, and take action

Trust Enthec to keep you safe in the digital environment.

 

Frequently asked questions about deepfakes

What exactly do deepfakes mean?

The term "deepfake" combines "deep learning" and "fake." It refers to any multimedia content generated or manipulated using artificial intelligence to impersonate a real person's appearance or voice without their consent.

Can a deepfake be made of anyone?

Technically, yes. By 2026, a single high-quality photograph could create a compelling animated video. That's why it's important to limit the public exposure of high-resolution images and implement digital identity monitoring protocols.

Are deepfakes illegal in Spain?

Using deepfakes without consent can be punishable under the GDPR, the Spanish Organic Law on Data Protection, and, in cases of harassment or extortion, the Spanish Penal Code. The European AI Act, in force since 2026, adds further obligations for creators of synthetic content in generative AI.

What is the difference between a deepfake and a shallowfake?

A deepfake uses artificial intelligence and neural networks to generate highly complex synthetic content. A shallowfake, on the other hand, is a simpler manipulation, such as slowing down a video, cutting out context, or editing subtitles, which doesn't require AI but can be just as deceptive.

How can I tell if a video of a video call is a deepfake?

In a real-time video call, watch for video quality issues (live deepfakes often have higher latency or inconsistent resolution), head movements at extreme angles (which current models distort), and unnatural facial expressions. In critical corporate environments, always establish a pre-agreed verification word with your contact.

Can deepfakes affect companies as well as individuals?

Yes, and with serious economic consequences. Deepfakes of executives, employees, or brand representatives are a growing vector of corporate fraud. Corporate cyber surveillance is the first line of defense for detecting these types of threats before they materialize.

---

by Enthec

How can your credit card data be stolen?

Spain is the third-most-affected European country for stolen credit cards sold on the dark web. According to a 2025 NordVPN study, Spanish users' banking data sells for an average of $11.68 per card, usually in bundles, suggesting the volume of compromised cards circulating in illegal markets. Meanwhile, in February 2026, Spanish banks and the OCU (Spanish Consumers' Organization) issued alerts after detecting a wave of fraudulent charges of just a few cents, designed to test whether a card is working before the final theft.

Knowing how your card details are stolen and what they do with them afterward is the first step to avoid becoming a victim.

 

Theft of credit card data in non-face-to-face transactions

In recent years, EMV systems have been implemented to prevent the physical cloning of credit cards. EMV is a payment method based on a technical standard for smart payment cards, payment terminals, and ATMs that can accept them. EMV stands for "Europay, Mastercard, and Visa," the three companies that created the standard.
That's why credit card vulnerabilities are more common during card-not-present (CNP) transactions.

 

How can they steal your credit card information? Most common forms

Cybercriminals use a variety of techniques to obtain your card details in both physical and digital environments. These are the most widespread methods currently used:

Phishing, smishing, and vishing

Phishing is the most common method. The attacker impersonates your bank, a courier company, or a payment platform (Amazon, PayPal, BBVA, CaixaBank, etc.) and sends you an email or SMS with a link to a fake website where you unknowingly enter your card details.

• Smishing: The same technique is used via SMS. You often see messages like, "Your package is being held, please enter your details to release it."
• Vishing: Phone call. The "fake bank technician" scam involves someone who detects a suspicious purchase and asks you to confirm details to cancel it.

In all cases, the objective is the same: for you to voluntarily enter the card number, expiry date, and CVV.

 

 

Web skimming (formjacking)

Web skimming, also known as formjacking, involves injecting malicious JavaScript code into the payment page of a legitimate online store. The code is completely invisible to both the user and the merchant. It captures card details as soon as they are entered and sends them to the attacker's server.

Skimming and shimming on ATMs and data phones

Although EMV (chip) systems drastically reduced classic skimming, criminals have evolved:

• Skimming: Installation of a physical device over the card reader of an ATM or point-of-sale terminal that copies the magnetic stripe. Modern models incorporate Bluetooth transmission to extract data remotely.
• Shimming: The most recent and difficult-to-detect variant involves criminals inserting an ultra-thin electronic strip (shim) into the card reader slot. This shim intercepts communication between the card's EMV chip and the terminal, allowing them to read enough data to create fraudulent magnetic stripe cards.

Corporate data breaches

When criminals attack a company that stores payment data, they can obtain thousands or millions of card records in one fell swoop. These breaches are especially profitable for attackers and are the primary source of leaked credit card information sold on the dark web.

Data stolen in corporate security breaches can take months to appear on illegal markets. This prevents users from linking the leak to a specific incident.

Public WiFi networks and man-in-the-middle attacks

When you connect to an unencrypted public Wi-Fi network (airport, coffee shop, hotel) and make a purchase, an attacker on the same network can intercept the communication and capture your card details. This technique, known as a man-in-the-middle attack, is less common today thanks to HTTPS, but it remains an active vector in poorly configured networks.

Malware and spyware on devices

Malicious apps or infected downloads can install a keylogger or spyware that records everything you type, including your card details when making online purchases.

 

Technique	Environment	How it works	Warning sign
Phishing / smishing	Online / Mobile	Email or SMS with a link to a fake bank website	Suspicious URL, urgency in the message
Vishing	Telephone	A call from "your bank" asking for details	No bank asks for the CVV over the phone.
Web skimming	Online stores	Malicious code in the payment form	Difficult to detect as a user
Physical skimming	ATMs and POS terminals	Device superimposed on the reader	Reader with loose or strange parts
Shimming	ATMs and POS terminals	Foil in the EMV chip slot	Almost impossible to detect with the naked eye
Data leak	Companies	Database breach in a business	Unknown charges weeks later
Public WiFi	Open Networks	Interception of the unencrypted connection	Password-free Wi-Fi in public places
Malware / keylogger	Own device	Malicious app or download records keystrokes	Strange device behavior

 

How are credit cards cloned?

Card cloning is the process by which criminals create a physical or virtual copy of your card using stolen data to make fraudulent purchases.

There are two main types:

• Physical cloning: Using data obtained from the magnetic stripe via skimming, criminals encode a blank card with that information. This allows it to be used in stores that still accept magnetic stripe cards (increasingly less common in Europe, but still common in some Latin American countries or for in-person purchases with outdated terminals).
• Virtual cloning (carding): Using the card's full details (number, expiration date, and CVV), criminals can make online purchases directly, without needing to manufacture any physical object. This has been the dominant method in Spain since the widespread adoption of the EMV chip.

The entire carding process operates like an industrial chain: some criminals steal the data, others validate it by making micropayments of cents to verify that the card is active, and a third group exploits it until the available credit is exhausted.

 

What can they do with your card details?

Once your card details are in the hands of attackers, the most common uses are:

Fraudulent use	Description
Direct online purchases	They place orders in online stores on behalf of third parties or with an anonymous shipping address
Selling on the dark web	They sell the data in packages to other criminals at an average price of €10 per card in Spain
Carding (test micropayments)	They make minimal charges (€0.50–€1) to verify that the card works before operating.
Creation of cloned physical cards	Using magnetic stripe data, they manufacture cards for use in chip-free POS terminals
Identity fraud	They combine your card details with other personal information to impersonate you.
Fraudulent transfers or tricks	In some cases, they can access online banking if they also have the login credentials.

 

 

My credit card was hacked: signs to detect it and what to do

If you suspect your credit card has been hacked, or that your data is part of a credit card leak, the signs often appear sooner than you think, although almost no one associates them with fraud until the damage is already visible.

These are the most frequent signs that indicate your card details may have been compromised:

• Unknown charges on your statement, especially micropayments of cents (a classic sign of carding).
• Notifications from your bank for purchases you did not make, even if you had the card at all times.
• Failed attempts to access your online banking from unknown devices or locations.
• You receive purchase confirmations for orders you didn't place. Sometimes on platforms you don't even know exist.
• Your card is declined for a routine purchase for no apparent reason (this may indicate the bank blocked it due to suspicious activity detected before you).
• Your bank details appear in a data breach alert, such as those issued by Qondar when it detects your credentials on the dark web.

Practical rule: Review your card transactions at least once a week. The sooner you identify a fraudulent charge, the easier it is to recover your money and the less damage it can do.

 

What to do if your card details have been stolen?

If you detect unauthorized charges or suspect that your data has been compromised, act in this order:

1. Call your bank immediately to block or cancel the card. Most have a 24-hour helpline. Do it even if you're not sure; it's free and reversible.
2. Document fraudulent charges with screenshots of the statement before the bank removes them from the visible history.
3. File a complaint with the National Police or the Civil Guard. This is necessary for the bank to process the refund and for the police investigation to move forward.
4. Request a chargeback from your bank. In cases of card fraud, European regulations (PSD2) require banks to return the amount immediately in most cases, except in cases of serious cardholder negligence.
5. Check if your data is circulating on other platforms using monitoring tools like Qondar. Credit card data breaches often expose other personal data as well.
6. Change the passwords on the platforms where you saved that card. (Amazon, PayPal, plataformas de streaming...).

 

How to protect your credit card data: a practical guide 2026

Online shopping

• Only buy from websites with HTTPS and recognized trust seals.
• Use single-use virtual cards for purchases at stores you don't know.
• Activate real-time notifications from your bank for every charge.
• Avoid saving your card details on platforms if you don't use them regularly.
• Never make purchases while connected to a public WiFi network without a VPN.

At ATMs and card payment terminals

• Visually inspect the reader before inserting the card. If it has loose parts, play, or anything stuck to it, do not use it.
• Prefer contactless (NFC) payment to push notifications whenever possible: it eliminates the risk of shimming.
• Cover the keypad with your hand when entering the PIN, even if you don't see any cameras.
• Preferably use ATMs located in bank offices or large establishments.

On your device and email

• Do not click on links in SMS messages or emails that ask you to confirm bank details, even if the sender appears to be your bank. Always access your account through the official app or by typing the URL directly.
• Keep your operating system and applications updated to close malware vulnerabilities.
• Activate two-factor authentication (2FA) on your online banking.

Continuous monitoring

Reactive protection has its limits; you act only after you know something has happened. Continuous monitoring of your data on the dark web, like that offered by Qondar, allows you to detect a breach before it can be exploited.

Learn more about personal privacy and how to protect it.

 

Qondar: Continuous monitoring of your banking data on the web and the dark web

Most credit card fraud goes undetected until the damage is already done. The problem is that weeks or months can pass between when your data is leaked and when a criminal uses it.

Qondar, Enthec's personal cyber-surveillance platform, solves exactly this problem. It automatically and continuously monitors whether your card details, such as the number, expiration date, and combinations with your email or phone number, appear in leaked databases, carding forums, dark web marketplaces, or any other source of exposure.

When it detects that your data is being transmitted, it alerts you in real time. So you can cancel the card, notify the bank, and block any use before the impact becomes greater.

You don't need technical knowledge. Qondar works in the background, like a permanent alarm system for your identity and digital assets.

 

Frequently Asked Questions

How can they steal my card details without taking the card from me?

Through digital techniques such as phishing (fake websites that impersonate your bank), web skimming (malicious code in online stores), or malware on your device. They can also use physical devices installed on ATMs (skimming and shimming) that capture data when you insert your card.

What is a leaked credit card?

A leaked credit card is one whose data criminals have illegally obtained and sold or distributed on dark web marketplaces or carding forums. In 2025, Spain was the third European country with the most leaked credit cards circulating on these markets.

How are credit cards cloned?

Through skimming (devices on ATMs that read the magnetic stripe) or shimming (sheets that intercept the EMV chip), criminals obtain data to manufacture counterfeit physical cards. In online environments, virtual cloning uses the card number, expiration date, and CVV to make purchases without needing a physical card.

How can I tell if my debit or credit card has been hacked?

The clearest signs are unfamiliar charges on your statement, purchase confirmations you didn't make, or your card being declined for no apparent reason. You may also receive alerts from your bank or tools like Qondar if your data appears in a data breach.

What can they do with my card details?

They primarily use them to make fraudulent online purchases, sell them on the dark web to other criminals, or create cloned physical cards. In some cases, they also combine them with other personal data to impersonate you with your bank.

Will the bank refund my money if my card has been hacked?

In most cases, yes, as long as you report it promptly and you were not grossly negligent. European regulations such as PSD2 require banks to refund the amount immediately in cases of card fraud.

Is it the same if my physical card is stolen as if my data is stolen?

No. If your physical card is stolen, the bank blocks it and issues a new one. If someone steals your data (number, expiration date, CVV) without you losing the card, you may keep using it without knowing it's compromised, while criminals use it online. That's why early detection is crucial.

How can I prevent my card details from being leaked?

Use single-use virtual cards for online purchases, activate real-time notifications, avoid entering data on websites without HTTPS, physically inspect ATMs before using them, and use continuous monitoring tools like Qondar to see whether your data has appeared in any data breaches.

 

---

by Enthec