.webp)
There are four main types of deepfakes: face swap, reenactment, lip sync, and full synthesis. Each one manipulates a different part of a face using a different underlying method. The type of deepfake determines what raw material an attacker needs, where the manipulation leaves traces, and which detection approach actually works. A defense tuned for face swaps can miss a lip-sync attack entirely.
This guide is for the people who have to make decisions about that risk: security leads, fraud and compliance teams, and product managers building identity verification (IDV) flows. By the end you will be able to tell the four types of deepfakes apart, explain the engines that produce them, and recognize the signals each one leaves behind.
We update this resource quarterly. Last update: Q2 2026.
- Four main types dominate: face swap, reenactment, lip sync, and full synthesis.
- Face swap changes identity; reenactment changes behavior; lip sync changes only the mouth; full synthesis invents a whole face.
- Lip-sync deepfakes are harder for humans to spot than face swaps because only a small region changes.
- Full synthesis needs no real person, making it the engine behind synthetic identities.
- Three engines build them: autoencoders, GANs (StyleGAN family), and diffusion models.
- GANs held roughly 69% of the deepfake technology landscape in 2024 (Mordor Intelligence).
- The Arup attack combined synthesis, reenactment, and voice cloning to steal about $25.6M in one day.
- Humans correctly identify high-quality video deepfakes only about 24.5% of the time (iProov).
What Is a Deepfake?
A deepfake is synthetic media (image, video, or audio) in which a person's face, voice, or movements are generated or altered by deep learning models so convincingly that the result is hard to distinguish from genuine footage. The term covers everything from a face pasted onto a different body to a wholly invented human who has never existed.
Researchers classify visual deepfakes along two axes. The first is how much of the face is touched: partial manipulation changes a single region (most often the mouth), while entire-face techniques replace or generate the whole face. The second is what kind of manipulation is applied. The most cited academic survey of the field groups visual deepfakes into face swap, puppet-mastery (reenactment), lip syncing, entire-face synthesis, and facial attribute manipulation, with audio deepfakes as a separate branch.
For practical security work, four types matter most because they drive the majority of fraud and disinformation incidents: face swap, reenactment, lip sync, and full synthesis. The Arup case, where a finance employee in Hong Kong wired roughly $25.6 million after a video call full of fake executives, combined synthesized faces, reenactment, and cloned voices in one attack. Most real incidents are blends, which is exactly why understanding the building blocks matters.
The Four Main Types of Deepfakes
At a high level, the four types differ in what they manipulate, whether they need a real source face, and how they are usually built.
1. Face Swap
A face swap replaces the face of the person in a target video with a different (source) identity, so the target appears to do or say whatever the original footage showed. This is the iconic deepfake and remains the most common in non-consensual imagery and identity fraud.
The classic face swap relies on an autoencoder architecture. Two encoder-decoder networks are trained, one per identity, sharing a common encoder so they learn a shared latent representation of a face. At generation time the decoders are swapped: the system encodes the target's expression and pose, then reconstructs it wearing the source identity. Tools such as FaceSwap, DeepFaceLab, and FSGAN popularized this approach. Because the swap is blended back into the frame, face swaps tend to leave seams: lighting and skin-tone mismatches along the face boundary, and flicker where the blend is imperfect.
In an IDV context, face swaps drive many account-takeover and onboarding-fraud attempts, often paired with injection techniques that feed manipulated video straight into a verification camera feed. See our explainer on presentation attacks versus injection attacks.
2. Reenactment (Puppet-Mastery)
Reenactment, also called puppet-mastery or face reenactment, keeps the target's identity intact but drives their expressions, head pose, and gaze using a separate puppeteer. Where a face swap changes who you see, reenactment changes what they do.
This is a motion-transfer problem rather than identity replacement. Early systems like Face2Face and Deep Video Portraits achieved real-time reenactment, and the First Order Motion Model showed a single source image could be animated by a driving video. Because the underlying face is genuine, reenactment artifacts cluster around dynamics: expressions outside the person's natural range, head and eye movements with subtly wrong timing, and identity-expression mismatch.
Reenactment is the engine behind putting words in someone's mouth, where a real public figure appears to behave in a way they never did. It is also core to live video-call fraud, where a likeness must move and react convincingly in real time.
3. Lip Sync
A lip-sync deepfake modifies only the mouth region of an existing video so the lips match a chosen audio track, making it look as if the person said something they never said. The rest of the face is left untouched, which is what makes this type so effective.
Audio-driven models such as Wav2Lip map phonemes (units of speech sound) to visemes (mouth shapes) and render frame-accurate mouth movement. Because only a small patch changes, lip-sync forgeries are unusually clean. Research is clear on the consequence: lip-synced deepfakes are harder for humans to spot than face swaps, yet they are studied far less than face-swap detection. The manipulation hides in the mouth interior, including the teeth, inner lips, and sound-to-motion alignment.
For fraud teams, lip sync is dangerous because it pairs naturally with voice cloning. A cloned voice plus a lip-synced mouth produces a statement video convincing on both channels at once, so detection must examine mouth-region consistency specifically.
4. Full Synthesis
Full synthesis (entire-face synthesis) generates a complete, photorealistic face that belongs to no real person. There is no source identity to swap and no target footage to edit; the face is invented. The familiar this-person-does-not-exist portraits are full-synthesis outputs.
Two model families dominate. Generative adversarial networks, especially the StyleGAN family, learn disentangled control over pose, identity, and texture and produce faces up to 1024x1024 pixels with no source image at inference. More recently, diffusion models, which start from noise and iteratively denoise, push realism further while producing fewer of the low-level artifacts older detectors relied on. With no blending step, full-synthesis images skip boundary seams; their tells migrate to backgrounds, ears, hair, accessories, and subtle asymmetries.
The security relevance is synthetic identities: fabricated personas (face, photo, and supporting documents) used to open accounts and seed fake networks at scale. Unlike the other three types, full synthesis impersonates no specific victim; it manufactures a person who can be reused indefinitely.
The Engines Behind Deepfakes
All four types are built on three families of generative model. Knowing which engine produced a deepfake matters because each leaves a different fingerprint.
Autoencoders and variational autoencoders are the workhorses of one-to-one face swapping; their reconstruction step introduces the blending artifacts many detectors exploit. GANs raised the fidelity ceiling and unlocked arbitrary synthesis but leave characteristic frequency-domain traces. According to Mordor Intelligence's deepfake AI market analysis, GAN-based methods still held roughly 69% of the technology landscape in 2024. Diffusion models are the hardest case for legacy detection: by producing far fewer obvious low-level artifacts, they undercut detectors that depend on texture or frequency irregularities.
How to Tell Them Apart: Detection Signals by Type
Because each type manipulates a different region with a different method, the evidence shows up in different places. A detector that only knows where to look for face-swap seams will be blind to a lip-sync attack hiding in the mouth.
This is why region-aware, explainable detection matters more than a single black-box score. DuckDuckGoose's DeepDetector, for example, is designed to flag face swaps, morphs, and lip syncs and to show which regions of the frame drove its decision, so an analyst can see why a clip was flagged rather than just that it was. For how reliably tools and people perform on these signals, see our analysis of deepfake detection accuracy.
Where These Types Show Up in Fraud
The distinctions are not theoretical. Different types map to different real-world attacks, and the losses are well documented.
Sumsub data compiled by Keepnet Labs shows deepfake fraud attempts rose roughly 2,137% over three years, from 0.1% to 6.5% of all fraud attempts, and U.S. deepfake fraud losses reached about $1.1 billion in 2025, triple the prior year. Human review is not a reliable backstop: studies put correct identification of high-quality video deepfakes at around 24.5%. For the full data picture, see our roundup of deepfake statistics.
Common Misconceptions
"A deepfake and a face swap are the same thing." Face swap is one of four major types. Treating them as synonyms leaves reenactment and lip sync unaddressed.
"If the rest of the face looks normal, the video is real." Lip-sync deepfakes deliberately leave the rest of the face untouched. That is the point.
"Newer deepfakes always look better, so detection is hopeless." Realism and detectability differ. Diffusion removes some artifacts but introduces others, and multi-signal detectors track cues that are hard to remove.
"Full synthesis isn't a fraud risk because it isn't impersonating anyone." Synthetic identities are built to pass onboarding and open accounts at scale, no specific victim required.
"Humans on a video call can spot a fake." The Arup case showed the opposite: multiple colleagues on a live call were all synthetic, and the employee was convinced.
Practical Recommendations
Map your defenses to the types, not to a single mental image of a deepfake. Make sure detection covers partial manipulation (lip sync) as well as whole-face techniques, since the two leave evidence in different places.
Treat verification as multi-layered. Process controls, such as callback procedures on a trusted channel, two-person approval for high-value transfers, and pre-agreed code words, caught or could have caught several documented attacks without depending on anyone spotting an artifact under pressure.
Prefer explainable detection over opaque scores. When a tool can point to the manipulated region, analysts can corroborate the finding and auditors can understand it. DuckDuckGoose AI, named among deepfake-detection vendors in industry market analyses (Mordor Intelligence), built its tooling around that explainability principle.
Finally, assume blended attacks. The highest-impact incidents combine synthesis, reenactment, and voice cloning, so a defense that only catches one type will be bypassed by the others.
Frequently Asked Questions
What are the four main types of deepfakes? Face swap (replacing one person's face with another's), reenactment (driving a real person's expressions and movements), lip sync (altering only the mouth to match audio), and full synthesis (generating a complete face of someone who does not exist).
What is the difference between a face swap and a deepfake? Deepfake is the umbrella term for any AI-generated or AI-altered synthetic media. A face swap is one type. All face swaps are deepfakes, but not all deepfakes are face swaps.
What is the difference between face swap and reenactment? A face swap changes the identity. Reenactment keeps the original identity but changes behavior, transferring expressions, head pose, and gaze from a driving actor.
Which type of deepfake is hardest to detect? For humans, lip-sync deepfakes are hardest because only the small mouth region changes. For automated detectors, diffusion-based full synthesis is especially challenging because it leaves few low-level artifacts.
Do all deepfakes use a real person's face? No. Face swap, reenactment, and lip sync start from a real face or footage. Full synthesis generates an invented face with no real source identity.
Are deepfakes made with GANs or diffusion models? Both, plus autoencoders. Autoencoders power most face swaps, GANs dominate full synthesis, and diffusion is a fast-growing newer family. Mordor Intelligence estimated GANs held roughly 69% of the landscape in 2024.
How are deepfakes used in fraud? CEO/CFO impersonation on live video calls, IDV bypass during onboarding, and synthetic identities for fraudulent accounts. The Arup attack cost roughly $25.6 million across 15 transfers in a single day.
This article is updated quarterly. Last update: Q2 2026.
.png)
About the author
