How to Spot a Deepfake Before It Costs You Money

By D. Ortiz · Published 2026-06-11 · 2005-word read

Scammers are deploying sophisticated deepfake videos to impersonate celebrities and pump crypto schemes. This guide shows how to spot a deepfake through visual glitches, audio desynchronization, and platform distribution patterns—plus free verification tools that catch what the naked eye misses.

Why Scammers Use Deepfake Videos to Target Crypto Investors

Scammers use deepfake videos because synthetic celebrity endorsements convert better than any text ad, and the production cost has collapsed to near zero. When I priced the tools myself, I found voice-cloning and face-swap services advertised for under $20 a month — cheap enough that learning how to spot a deepfake now matters more than any blockchain audit you'll ever run.

The economics are brutal. A borrowed face — Elon Musk, MrBeast, or a national news anchor — lends instant false credibility to a fraudulent platform that has none. The victim isn't trusting the platform; they're trusting the person they think is speaking.

The losses are not theoretical. The FBI's IC3 logged billions in crypto-related fraud through its annual reports, and the FTC has flagged impersonation scams as a top complaint category ✓ Verified.

CryptoKiller's analysis of 12,293 scam brands found 6,045 deploying celebrity impersonation — proof the synthetic-video playbook is now the default, not the exception.

What Does a Deepfake Actually Look Like? Common Visual Flaws

The jawline gives it away first. I learned this watching a fabricated Elon Musk "crypto giveaway" frame by frame on my laptop at 2 a.m., dragging the scrubber back and forth across a single second of footage. Along the edge of his jaw, the skin shimmered — a faint flicker where the synthetic face met the real neck, like heat rising off asphalt. Pause on any deepfake and study that boundary. The hairline does it too, individual strands smearing into the forehead.

Then I started counting blinks. Real people blink 15 to 20 times a minute, irregularly. The fake Musk blinked almost never, then blinked twice in rapid mechanical succession, as if the model remembered it had forgotten.

Watch the light. In one scam clip pushing a fake trading platform, the speaker's face was lit from the left while the window behind him threw shadows from the right. The model rendered the face and the room as separate problems and never reconciled them.

The mouth is where the illusion collapses entirely. When the subject smiles or speaks, look at the teeth — often a pixelated white smear, sometimes a single fused block with no individual teeth, the inner mouth a dark geometric void.

IC3 annual reports consistently flag impersonation and cryptocurrency fraud as top complaint categories, with billions logged in combined losses through 2024-2025.

— FBI Internet Crime Complaint Center (IC3), FBI IC3 Annual Report, 2024-2025

How Do Scammers Synchronize Fake Audio With Stolen Celebrity Footage?

Scammers build the fake in three stages: clone the voice, generate or repurpose the video, then stitch the two together with a lip-sync model. I traced the pipeline by examining clips flagged across CryptoKiller's analysis of 98,163 ad creatives, and the seams are visible to the naked eye once you know where to look.

The voice comes first. Cloning tools train on hours of a celebrity's public interviews, podcast appearances, and earnings-call recordings — material that sits free on YouTube. The model reproduces timbre well but stumbles on rhythm, producing a cadence that lands a half-beat off natural speech, with pauses inserted in odd places.

Where the sync breaks

Watch the mouth on hard consonants. P, B, and M sounds require the lips to fully close. Cloned audio plays those phonemes, but the stolen footage wasn't filmed saying them, so the lips stay open or close late. That mismatch is the single most reliable signal an investor can check without any tools.

Listen for the splice, too. Audio quality shifts abruptly — a clean studio voice suddenly carries room echo — when scammers cut between source clips.

Which Free Tools Can Verify Whether a Video Is AI-Generated?

Three free tools give retail investors a fighting chance against deepfakes: Microsoft Video Authenticator, reverse image search, and the InVID/WeVerify browser plugin. I tested each against a batch of celebrity-endorsement clips pulled from the kind of scam campaigns CryptoKiller tracks, and none worked alone.

Microsoft Video Authenticator scores frames for manipulation, flagging blending boundaries and grayscale artifacts the eye misses. It returns a confidence percentage, not a verdict — useful, but it hesitated on the cleanest clips I fed it.

Reverse image search attacks the problem from a different angle. I screenshotted a video thumbnail, dropped it into Google Images and TinEye, and traced one fake "interview" back to a 2023 CNBC segment the scammers had puppeteered. The original footage often exists, unaltered, if you hunt for it.

The InVID/WeVerify plugin lets you inspect frame-level metadata, dissect keyframes, and check upload timestamps against the claimed event date.

That lag is why layering matters. Across 98,163 ad creatives CryptoKiller has analyzed, the convincing fakes survive any single test. Run all three, then weigh the disagreements. No tool gives you certainty — it gives you reasons to doubt.

Analysis of 12,293 scam brands found 6,045 deploying celebrity impersonation tactics across 98,163 ad creatives, demonstrating synthetic-video fraud is now the default playbook.

— CryptoKiller Platform Analysis, CryptoKiller Scam Brand Database, 2026

How Do Scammers Distribute Deepfake Endorsement Videos Across Platforms?

Scammers push deepfake endorsement videos through 3 primary channels: paid social ads, Telegram investment groups, and YouTube pre-roll. I traced the same fabricated Elon Musk clip across all three in a single afternoon, each version routing to a different deposit page.

The ad accounts gave themselves away first. Each had been created within weeks, ran no other content, then suddenly pushed high-volume celebrity clips—a history too short for legitimate advertisers. When I checked CryptoKiller's analysis of 98,163 ad creatives, the pattern held across 6,045 brands abusing celebrity likenesses.

What platform signals expose a coordinated campaign?

Three signals recur in every campaign I examined:

• Comment sections disabled or scripted. Either comments are off entirely, or flooded with near-identical praise posted seconds apart.
• Urgency language in captions. 'Limited slots,' 'expires tonight,' 'only 50 spots left'—pressure designed to short-circuit research.
• Inflated view counts. Bot networks amplify cross-platform, so a clip with 400,000 views collects 12 real comments.

Follow the deposit link and the impersonation collapses. The destination, never the celebrity, tells you who's really behind it.

Step-by-Step Checklist: How to Spot a Deepfake Before You Invest

Five checks separate a real endorsement from a synthetic one, and each takes under a minute. Run them in order before you move a single dollar.

1. Zoom into the face edges. Pause where the jaw meets the neck and the hairline meets the forehead. I have found that deepfake generators struggle with boundaries — look for shimmer, blur, or a faint halo where the face was stitched onto the body.

1. Mute it and watch the lips. Audio masks bad sync. With sound off, I watch whether the mouth shapes match the words I think are being spoken. Plosives — the "p" and "b" sounds — are where fakes fall apart.

1. Check the real account. Open the celebrity's verified profile directly. If Elon Musk, Cathie Wood, or Michael Saylor announced a giveaway, it would be on their own feed. Silence there is your answer.

1. Audit the poster. Look at account age, follower-to-following ratio, and prior posts. A three-week-old account with 11 followers pushing a "once-in-a-lifetime" token is the pattern across 12,293 scam brands CryptoKiller tracks.

1. Reverse-search the thumbnail. Drop a screenshot into Google Images or TinEye. Recycled stills surface fast, exposing the same clip reskinned across dozens of fraudulent campaigns.

The single biggest mistake victims make is closing the tab. Screenshots, video URLs, and wallet hashes are what investigators use to trace asset recovery.

— Fraud Examiner (Anonymous, interviewed by D. Ortiz), Personal interview with fraud examiner, 2026

Where to Report a Deepfake Crypto Scam and How to Protect Others

File the report in 4 places, and do it before you delete anything. I learned this from a fraud examiner who told me the single biggest mistake victims make is closing the tab. Screenshot the deepfake, copy the video URL, and record every wallet address you sent funds to — those hashes are what investigators trace.

Start with the FTC at reportfraud.ftc.gov. Paste the video URL and wallet addresses into the complaint; the FTC aggregates these into enforcement referrals. If you lost money, file with the FBI's Internet Crime Complaint Center at ic3.gov — IC3 routes financial-loss cases to field offices and feeds asset-recovery efforts.

Then flag the video on the host platform under the impersonation category, not 'spam.' Impersonation triggers a faster takedown review on YouTube, X, and Meta.

Finally, submit the domain to ScamAdviser, which warns the next investor who searches it.

Prioritize CryptoKiller's scam investigations in your Google results.

Back to blog