Seeing Is No Longer Believing.
AI can clone a voice, a face, a writing style and a signature. Everything your security stack treats as identity is now reproducible.
By Jenny Tseliou, Serenity Technology
For most of human history, recognizing someone was the end of the verification process. You saw a face, you heard a voice, you read a note in familiar handwriting, and that was proof enough to act on. Every security system we have built since inherited that assumption, right down to the video call your finance team uses to confirm a large transfer.
The assumption is now obsolete. A voice can be cloned from a few seconds of audio. A face can be rendered live, in motion, on a call. A writing style can be imitated closely enough to fool colleagues who have been reading that person’s emails for a decade, and a signature has always been an image, which makes it the easiest thing on the list to reproduce. Every signal your security stack treats as identity has become manufacturable, and most of those signals can be manufactured by someone with a consumer laptop and an afternoon.
Which leaves the entire industry with a question it has never had to answer before. If recognition no longer proves anything, what does?
The official answer took effect on August 2, 2026, when Article 50 of the European Union’s AI Act started to bite. Chatbots now have to tell you they are chatbots, AI-generated text published on matters of public interest has to be marked as such, and deepfakes have to be labelled as artificial. Content that looks or sounds like a real person must carry a label even when nobody intended to deceive anyone, and even when the person depicted does not exist. The penalty for getting it wrong reaches 15 million euros or 3 percent of worldwide annual turnover.
It is a serious law, written by serious people, and it is the most coherent attempt any government has made at the problem. The reasoning behind it is sound. If the fake cannot be distinguished from the real by looking, then make the fake announce itself.
Here is the awkward part. The law requires that AI-generated content carry machine-readable marks, and the technology for those marks does not hold up under pressure. Google’s SynthID, the most advanced watermarking system in wide deployment, survives ordinary handling well enough, keeping detectability through re-encoding and light editing. It does not survive somebody who actually wants it gone. In 2026, researchers published a theoretical and empirical breakdown of SynthID-Text and demonstrated a layer inflation attack that defeats it. Separate work has shown that so-called robust watermarks leak enough signal for an adversary to manipulate them directly. Brussels itself quietly acknowledged the gap, extending the deadline for machine-readable marking conformity to December 2026 for systems already on the market.
So the honest summary of where we are is this. The label is mandatory for the people who were never going to lie to you, and optional for everyone else.
the question that cannot be answered anymore
Every effort to fix the trust problem so far has asked the same question of the artifact in front of us. Is this image real? Is this voice really him? Was this document written by a person?
That question is losing, and it is losing structurally rather than temporarily. Detection and generation are not two sides in a fair fight. A detector has to be right about everything, permanently, across every model, every format, and every future model nobody has trained yet. A forger has to get lucky once, with one file, in one moment when somebody is busy. Worse, every detector that gets published becomes a training target, because the fastest way to build a generator that beats detection is to point it at the detector until it stops complaining.
This is why the arms race framing is comforting and wrong. An arms race implies two sides trading advantages. What is actually happening is that the cost of manufacturing a convincing artifact keeps falling toward zero, while the cost of verifying one keeps rising, and no amount of investment on the verification side reverses that gradient. You are not going to detect your way out of this. Nobody is.
The interesting move, then, is to stop asking the question. Trust does not have to be a judgment about content. It can be a property of the actor.
the difference between inspecting the artifact and proving the actor
Consider two ways of handling the same problem, which is a payment instruction that appears to come from your finance director.
The first way is inspection. You look at the email, or you take the video call, and you ask yourself whether it feels right. Does the phrasing match how he writes? Does the face behave like a face? Is there something off about the audio? In 2020 that worked reasonably well, because manufacturing a convincing fake was expensive and rare. In 2026 the judgment is close to worthless, and asking a tired employee to make it correctly at half past five on a Friday is not a control. It is a hope with a job title.
The second way removes the judgment. The instruction is only valid if it carries proof that the specific human being holding a specific credential authorized it, and that proof cannot be produced by anyone else, no matter how perfectly they imitate his face, his voice, his writing, or his signature. Under that model the question of whether the video call looked convincing never comes up, because the video call was never what authorized anything.
Notice what changed. In the first model, trust is something you extend based on how things appear. In the second, trust is something the counterparty demonstrates before anything happens. The first degrades every time generative models improve. The second does not care how good the fake is, because the fake was never the thing being checked.
Get Serenity Technology’s stories in your inbox
Join Medium for free to get updates from this writer.
That distinction is going to separate the organizations that survive the next few years from the ones that spend a fortune on detection and get robbed anyway.
trust is now a line on the balance sheet
This industry has been calling trust valuable for years, usually in the soft register of brand and reputation. The 2026 data has made it much less soft.
A Qualtrics XM Institute study this year surveyed 10,000 repeat buyers across retail, finance, and healthcare, and found that 72 percent had permanently abandoned a brand after a single trust-breaking incident. Not reduced their spending. Abandoned. GlobeScan’s Radar survey, covering 27,000 consumers across 30 countries, found 76 percent now treat trust as an active purchase filter, with boycott incidents up 34 percent year over year. Separately, 43 percent say they would stop engaging with a company entirely if their personal data were misused.
Read those numbers as a pricing signal rather than a morality tale. They say that the cost of a trust failure is no longer a dip in sentiment that recovers over a quarter. It is permanent customer loss at scale, in a market where acquiring the replacement customer costs more than keeping the original one ever did. Trust has become the asset with the worst possible depreciation curve, which is to say it holds its value indefinitely and then goes to zero in an afternoon.
In Web3 the asymmetry is sharper still, because there is no chargeback, no fraud department, and no institution standing behind the transaction to make an aggrieved customer whole. What a bank can repair with a refund and an apology, a decentralized system cannot repair at all.
what has to be true underneath
If trust cannot come from inspecting content, it has to come from the layer below, which is identity. Not identity in the sense of a username and a claim, but identity that can be demonstrated cryptographically, tied to a specific human being, and impossible to hand over accidentally.
None of that makes cryptography a magic word, and it would be dishonest to present it as one. Proof-based systems carry their own dependencies, and Bitcoin holders spent the past weeks learning what happens when one of them fails quietly. A firmware error in Coldcard hardware wallets, sitting undisturbed for five years, left seed phrases far more predictable than anyone realised, and more than $100 million has been swept out of thousands of wallets since July 30. No attacker touched a device. They recomputed the keys. A system built on proof is still only as good as the weakest assumption underneath it, which is an argument for scrutinising that layer rather than for going back to trusting faces on a screen.
This is the architecture behind sAxess, Serenity Technology’s biometric crypto wallet card. The card holds the key, the key never leaves it, and the only thing that unlocks it is your fingerprint, read on the card itself. There is no password to be socially engineered out of you, no seed phrase to be typed into a convincing fake, and no code in transit that a synthetic voice can talk someone into reading aloud. A perfect deepfake of you still cannot produce your authorization, because the thing that authorizes is not a piece of information that can be copied or imitated. For organizations, sAxess Pro extends the same principle to internal governance, so that every sensitive action carries an unforgeable answer to the question of who approved it.
That last part is what regulators, insurers, and enterprise counterparties are all converging on, from different directions and for different reasons. They have stopped asking companies whether they can spot a fake. They have started asking whether they can prove who acted.
the label is not the trust
Europe’s transparency rules are a good law and they will do real good, mostly by disciplining the legitimate operators who were always going to comply. That is worth having. But it would be a serious mistake to read the labelling regime as the answer to the problem it was written for, because the marks it depends on can already be removed by anyone motivated enough to try, and the people you actually need protection from are precisely the motivated ones.
The label describes the content. The trust has to attach to the actor. Any system that confuses those two things is building its defenses on a sticker, and stickers come off.
So the question worth sitting with is not whether your organization can detect the next synthetic voice or forged document, because eventually it will not. The question is what still holds when detection fails completely, which it will, on a day when someone is busy and the request looks routine. If the honest answer is that everything downstream rests on an employee making a good judgment call about a face on a screen, then your security still runs on a rule that stopped being true. Seeing was believing for about two hundred thousand years. It had a good run, and it is over, and the organizations that plan around that now will be the ones nobody has to take on faith later.
Jenny Tseliou is a contributor at Serenity Technology, covering digital identity, authentication, and trust infrastructure.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess, a biometric crypto wallet card.
Related reading: $130 Million Left 7,300 Bitcoin Wallets. Nobody Touched a Single Device. | They Didn’t Hack the Fingerprint Scanner. They Hacked the Person Watching It. | AI in Web3: The Agents Hold the Keys Now. That’s Where the New Risk Lives.
Learn more at s.technology
Common questions
What changed on August 2, 2026 under the EU AI Act?
Article 50 transparency obligations came into application. Chatbots must disclose that they are AI, AI-generated text on matters of public interest must be marked, and deepfakes must be labelled as artificially generated, even when there was no intent to deceive. Penalties reach 15 million euros or 3 percent of worldwide annual turnover, and providers already on the market have until December 2026 to bring machine-readable marking into conformity.
If AI content is watermarked, is the problem solved?
No. Watermarking handles ordinary cases well, surviving re-encoding and light editing, but it was never designed to withstand a determined adversary. Researchers demonstrated a layer inflation attack against SynthID-Text in 2026, and other work has shown that robust watermarks leak enough signal to be manipulated directly. Labelling disciplines honest operators. It does not stop the people you need protection from.
Why is detecting deepfakes a losing strategy?
Because the economics run one way. A detector must be right about every file, every format, and every future model, while a forger needs one success at one moment. Published detectors also become training targets, since the quickest route to a better generator is to optimize it against the detector until it passes. Generation gets cheaper as verification gets harder.
How can a company verify a real person when deepfakes can fake a video call?
Stop treating what you see or hear as proof. Confirm payment and access requests through a separate channel you already trust, and for approvals that move money, tie the decision to something a clone cannot supply. With sAxess Pro, Serenity Technology’s access control card, an approval requires the person’s fingerprint read on the card they carry, and no copy of a face or voice can produce that.
How much does a trust failure actually cost a business?
More than most forecasts assume. A 2026 Qualtrics XM Institute study of 10,000 repeat buyers found 72 percent permanently abandoned a brand after one trust-breaking incident, GlobeScan’s survey of 27,000 consumers across 30 countries found 76 percent use trust as an active purchase filter, and boycott incidents rose 34 percent year over year. In Web3 the exposure is larger still, since there is no chargeback or fraud department to repair the damage after the fact.
