Convincing deepfakes are hard to spot, but you don’t need to be certain before reporting them.
Cyber criminals are using AI and automation to create convincing emails, messages, voices, videos and online profiles. These impersonation scams can appear to come from a colleague, senior leader, supplier or other trusted contact.
It’s important to remember that seeing or hearing someone is no longer enough to prove a request is genuine.
The question is not whether you can spot a deepfake. The question is whether you need to verify the request before you act.
Why deepfakes are difficult to identify
AI can help attackers create messages with fewer spelling mistakes, more natural language and a better understanding of how people communicate at UNSW.
A scam may begin with a work email, then continue through Teams, a phone call, text message or a personal channel. If the communication is outside the visibility of the University’s controls, we may no longer be able to protect you. A familiar voice, video or caller ID can make the request feel legitimate, particularly when it appears urgent or confidential.
Attackers may use information from social media, public profiles, third-party data breaches and other sources to create a believable story.
High-impact actions need independent verification
Be especially careful when a request involves:
- transferring money or making a payment
- changing supplier or bank details
- sharing sensitive information or documents
- providing passwords, authentication codes or access
- bypassing normal controls or processes
- acting urgently or keeping the request confidential.
A request can look and sound genuine while still being fraudulent. Don’t rely on the email address, caller ID, voice or video alone.
Pause and verify the person and the request separately using a trusted channel. For example, contact the person using a known phone number, an existing Teams conversation or a face-to-face check. Don’t use the contact details included in the request.
You can use the phrase: “I’ll verify this request and come back to you.”
Trust the process, not the pressure
Urgency, authority and secrecy are common manipulation tactics. They are reasons to slow down, not speed up.
Continue to follow existing approval, payment, access and document-sharing processes. If a request asks you to bypass those controls, treat it as a warning sign and escalate it.
Other warning signs include a new or personal communication channel, an unusual link or attachment, a request to upload a document or a change to familiar contact details.
You don’t need to prove that something is a deepfake before reporting it. If a request feels unusual, report it early so the appropriate team can help assess it.
What should you do?
If you receive a suspicious email, use the Report Phish button in your Outlook mailbox menu bar. Don’t reply to or forward the message. If it is malicious, this could help it spread further.
If a suspicious request arrives through Teams, phone or video, end the conversation calmly and verify it through a trusted channel.
If you have shared information, entered credentials, interacted with a suspicious link or acted on an unusual request, contact the IT Service Centre team as soon as possible. Early reporting can help limit the impact and protect others across the University.
Cyber security is everyone’s responsibility. Taking a moment to verify before acting can help protect UNSW’s people, information and systems.
- Log in to post comments