If someone steals your password, you can change it. But what happens when technology can imitate your face or your voice?
You’ve probably seen AI-generated videos where someone appears to say something they never actually said.
Maybe you’ve seen a still photograph suddenly start moving.
Or heard an AI-generated voice that sounds surprisingly similar to a real person.
These technologies are part of the world of deepfakes and synthetic media.
And they’re changing something important about life online:
Seeing or hearing something is no longer enough, by itself, to prove that it’s real.
What Is a Deepfake?
Simply put, a deepfake is media created or manipulated using technology to make someone appear to say or do something they didn’t actually say or do.
It can involve:
- a face,
- a voice,
- body movements,
- photographs,
- or video.
The technology itself isn’t automatically bad.
It can be used for entertainment, education, movies, accessibility, and many other legitimate purposes.
The problem is when someone uses it to deceive another person.
Imagine receiving a voice message that sounds like someone in your family asking for money.
What if you even see a video that appears to show that person?
The more convincing synthetic media becomes, the more important another skill becomes:
knowing how to verify who’s really on the other side.
A Photo Can Reveal More Than You Think
Think about an ordinary photo you might post online.
Obviously, it shows your face.
But look again.
Maybe it also shows your school.
A team uniform.
An employee badge.
Your house.
Your friends.
A place you visit frequently.
Or something else about your daily routine.
Now add a video where people can hear your voice.
Your professional profile might reveal where you work.
Other social media posts may show family members, trips, hobbies, birthdays, or places you spend time.
Individually, each piece may seem unimportant.
But cybersecurity isn’t always about one piece of information.
Sometimes it’s about putting the pieces together.
A photo provides appearance.
A video may provide voice and movement.
A profile provides context.
Other posts may reveal relationships and routines.
Together, those pieces can tell a much bigger story about you.
And for social engineering, context is extremely valuable.
The Risk Isn’t Simply “Someone Will Steal My Face”
There’s an important distinction here.
Uploading a photograph to a legitimate AI service does not automatically mean criminals will get your photo.
Different services have different rules for storing, processing, retaining, and using what you upload.
That’s why statements like:
“Never upload a photo to AI because AI will steal your face”
oversimplify the issue.
A much better question is:
How much of my digital identity am I sharing, who am I sharing it with, and why?
Some Things Are Hard to Replace
There’s a big difference between a password and your face.
If your password is compromised, you can create another one.
If your payment card is compromised, it can be canceled.
But you can’t simply change your face because a photograph circulated online.
You can’t easily replace your voice either.
That doesn’t mean you have to hide your face or stop posting videos.
It means we should recognize that our images, voices, and other personal characteristics are also part of our digital identity.
And they deserve thoughtful protection.
“But It Sounded Just Like Them!”
This is one of the habits we’ll have to change.
Imagine receiving this message:
“Hey, it’s me. I got a new number. I need you to send me some money.”
You might be suspicious.
But what if the next message is a voice recording that sounds exactly like the person?
Suddenly, the request may feel much more believable.
That’s why an unusual request involving money, passwords, verification codes, accounts, or sensitive information shouldn’t be trusted just because the voice sounds right.
Use another path to verify it.
Call the number you already know.
Contact the person another way.
Check with another family member.
For important decisions, verify through an independent channel.
Because in the age of deepfakes:
Looking real isn’t the same as being real.
Protect the Whole Picture
You don’t need to disappear from the internet.
Instead, pay more attention to the combination of information you’re sharing.
Before uploading a photo or video, ask:
What’s visible in the background?
Are other people in the image?
Am I revealing personal information without realizing it?
Do I trust the service receiving this file?
Do the permissions make sense?
Do I really need to upload this particular photo?
You don’t need advanced cybersecurity skills to answer those questions.
You just need to notice what’s there.
How This Makes You a Cyber Hero
For years, we’ve been taught that protecting ourselves online mostly means protecting our passwords.
Passwords still matter.
But your digital identity is much bigger than that.
It’s also your face.
Your voice.
Your photos.
Your relationships.
And all the little pieces of context you leave online over time.
AI is becoming increasingly capable of working with those pieces.
Our security habits need to evolve too.
You don’t have to stop being visible online.
You need to learn to be visible with awareness.
And when an important message relies on a face, voice, photo, or video to convince you it’s real, remember:
Verify another way before you trust it.
Daniel Porta
CISO | Cyber Resilience Architect | Enterprise & Workforce Resilience
Founder – Be a Cyber Hero