Chapter 100: Deepfake and Video Forgery — When the Eyes Lie

For thousands of years, humanity has relied on the sense of sight as the ultimate anchor of truth. "Seeing is believing," says the ancient proverb, reflecting our absolute certainty that if we saw something with our own eyes, it must have happened. In courts of law, eyewitness testimony has always been considered the "queen of evidence," and in daily life, the ability to recognize faces, perceive expressions, or detect a tone of voice in a video was the last line of defense against fraud. But in the era of Generative AI, this barrier hasn't just cracked — it has shattered into pieces. We are entering an era where our eyes are becoming weapons turned against us.

Over the years, and throughout the professional career of an attorney representing victims of digital scams, one can see how technology is evolving at a staggering pace. While scammers in the past had to settle for poorly phrased emails or phone calls with suspicious accents, today they are capable of creating an alternative reality. Deepfake is not just another "improvement" on a scam; it is a quantum leap. It is where machine learning algorithms map faces, lip movements, and human nuances to create a video of a person — sometimes someone known to their surroundings, or an employer — who says and does things that never actually occurred. This chapter is intended to help prepare for the moment when reality might distort before your eyes.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Sunday morning, 08:30 AM. Ronen, a CFO at a company, sat down at his computer with the first cup of coffee of the day. His calendar was packed, but an "Urgent" message that appeared in his Teams inbox startled him. It was the company's CEO, Gideon, who was at a conference abroad that week. "Ronen, are you available for a short video call? We must close the startup acquisition deal now, otherwise we will lose them," the message read.

Ronen turned on the camera, and Gideon's familiar face appeared on the screen. Gideon looked slightly tired — logical given the time zone difference — and the lighting in his hotel room was slightly dim. "Can you hear me, Ronen?" Gideon asked in his familiar raspy voice. "We have a two-hour window of opportunity. The lawyers are demanding a $450,000 advance to an escrow account to hold the offer. I'm sending you the account details by email now. Please approve the transfer immediately. I have to get back to the meeting."

Ronen noticed that Gideon looked stressed. He saw his characteristic hand gestures, the way he scratched his forehead when bothered. "Gideon, this is an unusual amount for a transfer without a physical dual signature," Ronen dared to say. Gideon sighed on the screen, his facial expression turning slightly impatient. "Ronen, I see you, you see me. I am authorizing this for you right here and now. The board has already been updated in principle. If we miss this, the responsibility is yours. I'm sending the details." The call disconnected. Seconds later, the email with the bank details arrived.

Ronen's gut feeling was uncomfortable, but he had seen the CEO. He had heard him. Ronen performed the transfer. Only in the evening, when he sent a personal WhatsApp message to Gideon asking, "How did the meeting progress after the transfer?", did the chilling reply arrive: "What transfer? We haven't spoken since this morning, I'm actually on a tour of another factory."

In this scenario, the victim did not fall for a regular human error, but for a Deepfake Video Call — one of the most sophisticated scams existing today. In this method, scammers collect visual and audio materials of the person (interviews, podcasts, social networks) and feed them into an artificial intelligence model that learns to imitate their face and voice in real-time.

The Technology Behind the Mask: How It Works and Why We Believe?

To defend ourselves, we must first understand the mechanism. Deepfake technology is based on Generative Adversarial Networks (GANs). These are two artificial intelligence algorithms working against each other: one algorithm (the "forger") creates an image or video, while the second algorithm (the "critic") tries to detect if it is a forgery. The process repeats itself many times until the product becomes difficult to distinguish from reality.

The central problem is human psychology. The brain is wired to trust facial recognition. When we see familiar features of a close or authoritative person, natural defense systems may relax. Scammers exploit this with an added element of urgency, which creates a situation where the focus shifts to solving the problem instead of examining the source's credibility.

Furthermore, the quality of deepfakes has improved significantly. In the past, it was possible to detect "jumps" in the image or lack of coordination, but today the technology allows for the creation of a digital character that reacts in real-time. In video calls where connection quality is not perfect, it is easy to disguise technical flaws as normal communication issues.

The Legal Arena: Analyzing Liability in Deception Scenarios

When funds are transferred following a deepfake scam, the legal question of who bears the responsibility arises: Is it the payer who executed the transaction, or the financial institution that is supposed to protect the funds?

In Israel, the central regulatory framework is the Payment Services Law, 2019. The law regulates the relationship between a client and a payment service provider. In the case of "unauthorized use" of a payment instrument, the law tends to protect the client, but deepfake scams pose a unique challenge because the action is usually performed by the client themselves under false pretenses.

In these cases, a claim may be raised by financial institutions that the client acted with "gross negligence." Conversely, one can examine the legal argument that the standard of care should change according to technological development. If tools are used that are beyond the average person's capacity for perception, the question arises whether the victim can be attributed with gross negligence.

Courts may examine the "balance of fault": Did the financial institution detect unusual activity? Were the automated systems supposed to stop a transfer of an unusual amount to a high-risk destination without human verification? There is a possibility to examine the institution's liability if it is proven that reasonable precautions were not taken to prevent fraud in an era where cyber risks are known to the system.

Beyond the Payment Services Law, one can examine claims from the field of tort and contract law, such as negligence of service providers or the level of organizational protection. However, recovering funds in such cases is a complex process that depends on the circumstances and the timing of the scam's detection.

Privacy Infringement and Identity Theft

Another legal aspect concerns the Privacy Protection Law, 1981 and the Defamation Law. Creating a deepfake video that attributes things to a person that were not said may be considered a violation of privacy and reputation. One can examine legal options such as passing off or infringement of autonomy, and sometimes take action against parties that allowed the data breach that was used to create the forgery.

An Abyss of Distrust: Potential Consequences

The great danger of deepfakes is the erosion of trust. In a situation where it is difficult to rely on seeing with our own eyes, the human and business fabric could be damaged. Managers might become suspicious of instructions, and courts will need to deal with new evidentiary challenges regarding the authenticity of visual evidence.

At the organizational level, one might consider moving to a "protocol-based verification" model. Just as digital signatures are used, it may be necessary to verify identity using additional means that do not depend solely on outward appearance.

How to Detect the Undetectable? Warning Signs and Defense Methods

Despite the sophistication of the technology, sometimes suspicious signs can be detected if one remains vigilant.

Possible Technical Signs in a Video Call:

• Unnatural blinking: Some models struggle to mimic a natural human blinking rhythm.
• Mouth and teeth area: Mismatch between lip movement and audio, or blurring around the mouth during rapid speech.
• Shadows and facial angle: A forgery that might look "smeared" during sharp head movements or a mismatch of shadows relative to the light source.
• Audio quality vs. video: A combination of high-quality audio with video that looks synthetic or of poor quality.

Defense Tactic: Human Verification Code

A simple method for coping is establishing a "code word" or a personal question with family members or colleagues, the answer to which is not available online. In case of suspicion, one can ask a personal question that only the other party should know the answer to immediately.

Recommended Steps in Case of Suspicion or Harm

In these cases, the speed of response is critical:

1. Stop Communication: In case of suspicion, it is recommended to disconnect the call immediately.
2. Verification through a separate channel: Contact the person through another communication medium (a regular phone call, a message on a different channel).
3. Report to the financial institution: In the event that a transfer was made, contact the bank's call center immediately to examine the possibility of canceling or stopping the transfer.
4. Documentation: Saving screenshots, email details, and any other technical details related to the incident.
5. Report to authorities: Filing a complaint with the police (Cyber Unit) for official documentation.
6. Legal review: It is recommended to examine the case with experts in the field to understand the options for action against the involved institutions.

Legal Aspect: Summary of Options

The legal situation is in the process of adapting to the new reality. There are several legal principles that can be examined:

1. The Financial Institution's Duty of Care

One can examine whether the financial institution fulfilled its fiduciary duty and duty of care, and whether appropriate verification mechanisms were activated before performing unusual actions.

2. Examination of the Concept of Negligence

One can argue that yielding to advanced technological manipulation does not amount to "gross negligence," as it is a representation intended to mislead even a reasonable and cautious person.

3. Insurance Coverage

In the case of organizations, one can examine whether existing cyber insurance policies cover events of technology-based social engineering.

In conclusion, in an era where the eyes can deceive, one must rely on verification processes, critical thinking, and legal protections. Reality requires us to learn to verify what we see and act with the professional tools available to us to protect our rights.

Warning Signs (Checklist):

• Urgent request for a wire transfer in an unscheduled video call.
• Visual glitches or artifacts in the area of the face and eyes.
• Vocal intonation that seems uniform or too robotic.
• Difficulty of the other party to answer spontaneous personal questions.
• Email addresses with minor changes intended to mislead.

What can be done immediately?

• Disconnecting the call and verifying with the person through a separate communication channel.
• Notifying security or financial personnel in the organization.
• Urgent contact to the bank to examine possibilities for canceling transfers.
• Examining legal options regarding the liability of the involved parties.

Central Legal Aspect:

The Payment Services Law provides protection to the client, and the chance of recovering funds depends largely on the circumstances of the case and the question of whether the case will be classified as negligence. It is recommended to examine each case individually against the current provisions of the law.