Your Face Just Became a Password You Can't Change

Piers Morgan is a man who makes his living on camera. His mother knows his face better than almost anyone. And earlier this year, a deepfake — an AI-generated fake video (a video that looks completely real but was entirely made by software) — fooled her completely. She believed she was watching her son. She wasn't. If it can happen to his own mother, it can happen to yours.

Here's the thing nobody's saying loudly enough: the big AI regulation debate you keep hearing about isn't just some policy argument in Washington. It is already inside your phone, your kid's social media account, and your bank app. It is shaping whether the face staring back at you from a video is real — or a very convincing lie.

This week, that reality got impossible to ignore.

The Rule Writers Are Playing Catch-Up

Twenty-five U.S. states, plus the U.K., Australia, and Spain, have now passed laws requiring age verification online — meaning apps and websites must confirm how old you are before letting you in, according to ACE. The idea sounds sensible: keep kids away from content built for adults. Fine. But here's the problem nobody warned you about. To check your age, many of these systems need your face. Or your government ID. Or both. So to protect your child's privacy, you hand over your own biometric data to a platform you've never fully trusted.

And then what happens to that data? That is the question regulators are still arguing about while you've already uploaded your face. This article is part of a series — start with How Deepfake Video Detection Actually Works.

The Federal Trade Commission has warned companies they cannot lawfully collect and hoard biometric data just because a law told them to verify your age. But the warning and the actual enforcement? Those are very different things. New transparency rules — requiring companies to label AI-generated content and disclose when you're talking to a bot rather than a human — don't become enforceable until August 2026, according to Pearl Cohen. That's a long time to wait when the fakes are already in your feed today.

Read that number again. The systems built to check that you are really you — the ones that ask you to blink, turn your head, or hold up your ID on camera — are being attacked more than a thousand percent more often than last year. The fraudsters are not waiting for the rules to catch up. They are already ten moves ahead.

The Problem With "Just Verify It"

So why not fix this with better technology? Build smarter detection, right? Except here's where it gets genuinely uncomfortable. Fintech Global reports that deepfake usage in identity fraud attempts surged 58% — meaning the fake faces used to fool verification systems are now nearly as common as people trying to log in legitimately in some fraud-heavy sectors. U.S. consumers lost $47 billion to identity fraud and scams in 2024 alone, with 18 million people falling victim to traditional identity theft.

Those aren't abstract numbers. That's your neighbor. Your coworker. Maybe you.

And there's a darker twist that legal experts have started calling the "liar's dividend." The idea is this: once everyone knows deepfakes exist, real evidence starts to seem fake too. A real video of someone committing fraud? Their lawyer says it's AI-generated. A genuine photo? Could be synthetic. The more convincing the fakes become, the easier it is for bad actors to dismiss the truth as a forgery. Regulators didn't see that coming when they started writing the rules, according to BSK Law. Previously in this series: That 95 Face Match It Could Mean 500 000 People.

"AI is so powerful, a deepfake of me duped my own mother." — Piers Morgan, as reported at SXSW London / Deadline

That quote deserves to sit there for a second. This is a man who has been on television for decades. His face is one of the most recognized in British media. His own mother — someone who has looked at that face her whole life — was fooled. The technology is not a party trick anymore.

Your Kid's Account Is Already in the Middle of This

One of the most quietly alarming stories this week came not from a tech company but from a law update. States including Idaho, Oregon, and Washington are now expanding their children's online safety laws beyond just social media — they're adding chatbots, AI companions, and interactive AI tools to the list of things that must confirm a child's age, according to MultiState. That means the homework help app, the AI tutor, the creative writing bot your teenager uses — all of it is now under the same scrutiny as TikTok.

But here's the uncomfortable side effect nobody's leading with. When states passed the first wave of age verification laws, VPN usage — that's when people use software to disguise where they are online and dodge local rules — spiked by 1,500 percent in those states, according to Jikimi. The rule meant to protect your kid pushed them toward a less regulated, less monitored version of the internet instead. Good intentions, messy results.

The Mindset Shift You Actually Need

Look, nobody is saying you should never trust anything you see online. That way lies paranoia and a very exhausting life. But the old instinct — "it looks like them, it sounds like them, it must be them" — is no longer reliable. That instinct is called the availability heuristic by psychologists: we trust what feels familiar. Scammers and fraudsters have always exploited that. Now they have AI to do it at scale, on demand, for almost no cost.

The practical shift is this: familiarity is no longer proof. A video of your family member in distress, asking for money urgently? Pause. Call them on a number you already know. A profile that looks exactly like your colleague, asking you to click a link? Verify through a separate channel before you act. This isn't about being paranoid — it's about adding one extra step before you respond to anything that feels urgent and familiar at the same time. Urgency plus familiarity is now the exact recipe scammers use to get past your defenses. Up next: That Urgent Video From Your Boss Your Eyes Cant Catch The Fa.

If you've ever looked at a photo or a video and wondered whether the person in it is genuinely who they claim to be — that instinct is right, and it's worth trusting. Forensic facial comparison, done properly, is one of the few tools that can actually answer that question with evidence strong enough to hold up when it matters. Not every situation needs it. But knowing it exists — and that it's different from a casual reverse image search — is worth filing away.

The Florida attorney general made headlines this week by pointing to an AI chatbot's role in a man's death — arguing that without regulation, these tools remain dangerous and essentially unaccountable. That case is still being argued. The rules are still being written. Sam Altman visited Capitol Hill to weigh in. The EU's AI Act is in motion. States are fighting the federal government over who gets to set the standards, as KHOU News reported this week.

All of that matters. But while the arguments play out in hearing rooms and legal briefs, the deepfakes are already in your mom's inbox — and they already know exactly what your face looks like.

Question worth sitting with: What would actually make you feel safer — stricter rules written before AI tools reach consumers, or better ways to verify what's real after something already looks suspicious? Because right now, we're getting neither fast enough — and that gap is exactly where the fraud lives.