Most People Can No Longer Tell Real From Fake. That Breaks How Your Company Verifies Anything.

Eighty-eight percent of people can no longer tell what is real online

Nearly nine in ten adults now say they cannot reliably tell genuine content from something a machine made. That figure comes from a Malwarebytes survey of 1,500 people across the United States, the United Kingdom, and German-speaking Europe, published in June 2026. A year earlier, the share who found it hard to separate a scam from the real thing was 66 percent. This year it is 85 percent. The number is not measuring fear. It is measuring a capability that most people have quietly lost.

For a security team, that loss is not a consumer-trends footnote. The instinct your staff use to judge whether a video call, a voice, or a document is authentic is the same instinct the survey says is failing. This article is about what replaces it, because the old answer, train people to spot the fake, is running out of road.

What the research found

The Malwarebytes report, titled Face value, surveyed adults in the US, UK, Germany, Austria, and Switzerland in March 2026. Half of respondents said they had hit some form of AI-driven scam in the past year: a personalized message, a manipulated review, a cloned voice, or a fake image. Exposure was highest among the youngest adults, not the oldest, with 67 percent of Gen Z respondents reporting an encounter. Eighty-four percent said convincing video no longer feels like proof of anything. Many are responding by withdrawing, posting less, deleting old photos, and stripping personal details about their families from public profiles.

The reason this is getting worse, rather than levelling off, is technical. A deepfake (synthetic audio, image, or video generated by AI) used to leave seams. Detection tools learned to read those seams: the faint blending where a swapped face met the original, unnatural blinking, frequency artifacts in the pixels. Researchers at the Vector Institute, a Canadian AI research body, reported in May 2026 that those tells are disappearing. Modern systems built on diffusion models (the generation method that paints an entire frame from noise rather than splicing one face onto another) leave no blend to find, and newer video generators reproduce the physiological cues, the pulse and the micro-expressions, that detectors once relied on. The Vector team calls the gap the Generalization Illusion: a detector scores well on a benchmark, then quietly fails on content from a generator it has not seen before. Detection, used on its own, is losing this arms race by design.

• 85 percent of respondents find it hard to tell a scam from a legitimate message, up from 66 percent in 2025.
• 84 percent no longer treat realistic video as proof, and half reported a personal brush with AI fraud in the past year.
• Few people have adopted any concrete defense, such as a family code word, content watermarking, or data removal.

Why this lands on your organization, not just the public

The immediate cost is a population that no longer trusts what it sees and is pulling back from the open internet to cope. The cost that should reach your next risk review is narrower and sharper. Your employees sit inside that 88 percent, and most enterprise verification still leans on exactly the signal the survey says has failed: a face on a video call, a recognizable voice approving a payment, a document that looks signed. If 84 percent of people already distrust video as proof, the deepfake CFO call that drained 25 million dollars from the engineering firm Arup in 2024 is no longer an exotic edge case. It is the template, and your finance and help-desk staff run on the same trust reflex the victims used. The systemic shift underneath all of this deserves to be named out loud. The contest has moved from detecting fakes to proving authenticity, because detection is losing and provenance is not. The organizations that come through this are the ones that stop asking does this look real and start asking can this prove where it came from.

What to do about it

1. Stop authenticating people by how they look or sound. Verify any sensitive request out of band, with a callback to a number already on file or a pre-agreed challenge phrase, because synthetic video and voice cannot pass a check the attacker does not control.
2. Adopt content provenance for the media you produce and trust. Use content credentials built on the C2PA standard, which attach a tamper-evident record of origin to a file, so authenticity becomes something you verify cryptographically rather than guess at by eye. See the C2PA standard.
3. Redesign approvals so no single video or voice can move money or grant access. Require a second, independent channel for high-value actions, because one cloned executive on a call should never be sufficient on its own. CISA, the NSA, and the FBI lay out organizational steps in their deepfake threats guidance.

Bottom line

The survey reads like a story about anxious consumers. It is really a status report on a control your organization still depends on. The human ability to tell real from fake, the thing behind every I recognized her voice and I saw him sign it, has degraded to the point where most people admit they can no longer do it, and the software meant to do it for them is falling behind the generators it chases. The durable answer is not a better eye or a smarter detector. It is provenance and process: proof of origin on the content that matters, and verification steps that do not collapse the moment a face or a voice turns out to be manufactured. Bring one question to your next security meeting. If a flawless fake of your CEO arrived tomorrow, what in your process, not your staff's intuition, would catch it?