Summary: AI has become so capable that it can now replicate the very signals we use to recognise a real person, a voice, a face, a writing style. With bots making up 53% of all web traffic in 2025 (40% of it malicious), and deepfakes surfacing in hiring pipelines, government communications, and financial transactions, no single verification check can be trusted on its own. The Turing Test has effectively flipped: the harder question is no longer whether a machine can pass as human, but whether a human can prove they are not a machine. The blog examines real-world cases to illustrate how broadly and rapidly this threat has scaled. The solution is not a better single check, but a layered identity strategy: combining liveness detection, injection attack detection, device identity, and behavioural signals so that faking any one input is never enough to get through.
Here is an awkward truth about the internet: humans are now the minority. Bots made up 53% of all web traffic in 2025, leaving people with just 47%, according to Thales’s 2026 Bad Bot Report.
Some of those bots are polite search crawlers. The bad ones, built to scrape, impersonate and defraud, now account for 40% of all traffic, up from 37% a year earlier. The problem of bad bots is a major one and it’s growing bad every year. Why do you think this issue is growing bad?
The real problem is that AI can now copy the very signals we use to recognise a real person: a voice, a face, a writing style. As a result, a message, call or login can look entirely human without being human.
This article traces how attackers exploit that gap, from cloned voices to fake job candidates and deepfaked faces, and what organisations can do to counter these AI impostors. The short answer: no single check can prove who is on the other end anymore, so trust has to be built from several layers at once.
The Turing Test Has Quietly Flipped
In 1950, Alan Turing asked whether a machine could pass as human. Today, the harder puzzle runs the other way: can a human prove they are not a machine?
The CAPTCHA was supposed to settle the matter. Instead, AI-enabled bots keep getting better at cracking CAPTCHAs, while the rest of us squint at blurry traffic lights and question our life choices.
If machines can beat our cheapest test of humanity, the next target is obvious. Attackers now go after our most trusted one: a familiar voice.
When the Voice on the Line Is Fake
Hearing is no longer believing, even at the top of government. In June 2025, an impostor used AI to clone US Secretary of State Marco Rubio’s voice and writing style, then contacted three foreign ministers, a US governor and a member of Congress over Signal.
The fake account even carried the display name Marco.Rubio@state.gov. A State Department cable said the impostor was likely acting “with the goal of gaining access to information or accounts.”
A cloned voice, like the one in the Rubio case, buys an attacker only a few minutes of trust. Some impostors aim for complete access to an organization and its data. They fake their way through job interviews and get hired, which brings us to the next threat.
The Colleague Who Never Existed
For an impostor, a job offer is the ultimate prize: a salary, a company laptop and trusted access to internal systems. Gartner predicts that by 2028, one in four candidate profiles worldwide could be fake, armed with fabricated IDs, invented work histories and AI-assisted interview answers.
Candidate fraud is no longer hypothetical. In a Gartner survey of 3,000 job seekers, 6% admitted to interview fraud, either posing as someone else or letting someone pose as them.
Forrester predicted that deepfakes would go mainstream in 2026, and hiring data shows it was right. In Greenhouse’s 2025 AI in Hiring Report, 18% of hiring managers had already caught applicants showing up as deepfakes, and 74% were more worried about fake credentials and deepfakes than a year earlier.
Employers are fighting back, and many are bringing back in-person interviews to verify that candidates are who they claim to be.
In-person interviews are not always possible, though, especially for remote and global roles. For most hires, recruiters still rely on seeing the candidate’s face on camera, and faces can now be faked as convincingly as voices.
Why No Single Signal Settles It
Video checks are only as reliable as the camera feeding them. Attackers can now inject synthetic video straight into the verification stream, skipping the camera entirely, so a face check can be fooled without anyone ever facing a lens.
The wider market is responding too. As deepfakes shift from damaging reputations to directly making money for fraudsters, Forrester expects spending on deepfake detection to grow by 40% in 2026.
Detection helps, but no single signal can carry the proof on its own. A voice, an email address, a face or a password can each be copied, but copying all of them convincingly at the same moment is far harder.
Proof of Humanity Is Becoming a Layered Game
If no single signal can be trusted, the answer is to stack them. Effective programmes combine liveness detection, injection attack detection, device identity and behavioural signals, so that faking any one signal is never enough.
Process matters as much as technology. Organisations should verify high-value requests through a separate, known channel, treat urgency and secrecy as red flags, and apply identity checks consistently across hiring and payments.
People still play a role too. A culture that rewards pausing to double-check, even when the voice sounds exactly like the boss, turns instinct into a control.
The Road Ahead
Layered identity checks will matter even more as bots stop being mere impostors and start doing real work on our behalf.
Soon, your AI agent may negotiate with another company’s AI agent while both humans sleep. That future could be efficient, even delightful, but only if every interaction can still answer one essential question: who, or what, is on the other end?
Until we can prove identity reliably, the wisest default is simple. Verify first, trust second, and never let a familiar face or voice stand in as proof of who is really there. Enterprises need help in this aspect, and from where you receive that help defines your security and strength. For reliable identity management, please contact us
