Security experts recommend low-tech protocols as AI deepfakes evade detection

AI deepfakes have evolved to the point where traditional verification methods, voice recognition, video calls, or behavioral tells, are no longer trustworthy. The Arup incident, where AI clones of executives authorized $25 million in fraudulent transfers, demonstrates that even trained employees cannot reliably distinguish real from synthetic interactions. This undermines the long-standing assumption that seeing and hearing someone is sufficient proof of identity. For engineers, this means authentication systems built around biometric or perceptual cues must be redesigned or supplemented with alternative controls.

The unreliability of human detection is backed by research: studies show accuracy rates barely above chance, even with training. Automated detection tools, which analyze audio-visual artifacts for signs of manipulation, are also failing as deepfakes improve. Government agencies like the NSA and CISA have explicitly ruled out these methods as effective defenses. This leaves organizations with few options for real-time verification, forcing a return to older, non-digital protocols. The trade-off is clear: low-tech solutions may slow down workflows but provide a layer of security that AI cannot yet bypass.

Low-tech solutions, such as pre-agreed passphrases, secondary confirmation channels, or in-person verification for high-value transactions, are being recommended by security experts. These methods are not new but were often deprioritized in favor of convenience and scalability. Their revival highlights a broader trend: as AI-driven attacks grow more sophisticated, defenses must become more manual and context-specific. For engineers, this may require integrating these protocols into existing systems, such as requiring dual approvals or physical tokens for sensitive operations.

The shift to low-tech defenses is not without challenges. Scalability is a major concern, as manual verification processes are harder to automate and may introduce bottlenecks. Additionally, these methods rely on human discipline, which can be inconsistent. However, the alternative, continuing to rely on easily spoofed digital cues, is riskier. The KnowBe4 incident, where a security firm was infiltrated by a North Korean operative using AI-assisted impersonation, underscores that even organizations with strong security awareness are vulnerable. Engineers must now balance usability with resilience, designing systems that can adapt to an era where digital trust is no longer guaranteed.