Deepfakes for fraud: the industry makes them in seconds, the law takes 48 hours to delete them

By Pulzo · September 13, 2026.

A deepfake —hyperrealistic video, audio or imagery generated with artificial intelligence that makes a real person say or do something that never happened— is no longer just the ingredient of a viral prank. As ESET, the cybersecurity firm, warns, these pieces are increasingly being used to extort, harass, defame and scam, taking advantage of technology that allows them to be manufactured at minimal cost and at enormous speed. The legal response, meanwhile, is advancing in fragmented fashion country by country: in the United States the TAKE IT DOWN Act is in force, requiring platforms to remove reported non-consensual intimate content within a maximum of 48 hours; the United Kingdom set the same deadline with its Online Safety Act and its Data Act; and the European Union will ban, under the AI Act, systems designed to create that type of imagery, leaving the remaining cases —fraud, blackmail, impersonation— in the hands of each member state's legislation.

The piece, aimed at a Colombian audience, spells out the recommended protocol: preserve screenshots, URL, username and date; avoid interacting with the account spreading the content so as not to amplify its reach; and report it on each network —Facebook, Instagram, TikTok, YouTube, X— precisely explaining the harm (fraud, harassment, impersonation) and not merely that «it's AI». For non-consensual intimate images, the specialized route is StopNCII.org, run by the British organization SWGfL, which generates a digital fingerprint of the file so that Meta, TikTok, Reddit and X can block matches without the image having to be uploaded to any server; for minors there is the equivalent, TakeItDown.NCMEC.org. Mario Micucci, an ESET Latin America researcher quoted in the article, sums up the key criterion: be specific about the harm and be persistent, contacting the platform, the search engine and the regulator in parallel.

Our reading: this catalog of procedures portrays an asymmetry that defines much of generative AI's short-term security problem. Making a deepfake takes minutes and ever less money; taking it down requires screenshots, forms, a 48-hour legal deadline where a law exists, and the patience to escalate case by case where it does not. It is the same underlying logic we see on other AI governance fronts: the bottleneck is not the technical capacity to create or detect synthetic content, but the institutional friction involved in acting on it in time.

There a gap emerges that the piece itself hints at without saying so: written for Colombian readers, it cites no Colombian law equivalent to the TAKE IT DOWN Act or the AI Act. All the scaffolding with teeth that it mentions —binding 48-hour deadlines, the right to erasure under Article 17 of the GDPR, data protection authorities— belongs to the United States, the United Kingdom and the European Union. A user in Bogotá or Medellín can turn to StopNCII.org or file reports on each network, but does not have the same legal leverage with a mandatory deadline that someone in London or Munich does. More broadly, that inequality of protection between regulated jurisdictions and the rest of the world is one of the least discussed side effects of a generative AI distributed globally while the law remains, by design, local.

In the long run, the reasonable way out is not just to litigate faster, but to make verifying cost as little as generating: digital fingerprints like StopNCII's, content provenance credentials or verifiable watermarks would have to come built in by default into the very tools that manufacture these images today. That is the trust infrastructure needed for AI to deliver on its promise of abundance without every technical advance simultaneously opening a new avenue for fraud. In the meantime, the short term keeps looking like this: the victim turned improvised investigator, form in hand, running after a technology that has already moved on.