Today I learned AI did not create an AI person for my mockup. It gave me someone who was already pretending to be real everywhere else.
I was scrolling through a website and stopped dead because I recognized one of the faces.
Not “that person looks familiar.” The exact person.
Not from real life. Not a celebrity. From a solution mockup I had generated with AI.
So I ran a Google image search. Same face, different names. Product reviews. University staff profiles. Social accounts. Even LinkedIn profiles.
This person had a more active professional life than most of us. They just apparently did not exist.
Which is admittedly awkward coming from someone who uses AI-generated versions of himself in some—okay, all—of his posts.
But this was different. The image was not sitting in one obvious fake account. It was being reused everywhere the internet needs a small dose of credibility.
A face has become a reusable prop
For years, a photo did a small but important job online. It made a profile feel real. A review feel real. A student, vendor contact, applicant, customer, or “industry expert” feel real enough that nobody asked a second question.
That was never identity verification. It was visual plausibility. We just treated it like verification because it was convenient.
Now a convincing face, polished bio, active profile, and a few believable interactions are cheap to manufacture. They are not proof. They are set dressing.
The issue is not only a deepfake CEO calling Finance and asking for a wire transfer. We know to worry about that version because it is dramatic.
The more common problem will be quieter:
- A plausible applicant whose history does not quite hold up.
- A vendor contact with a professional-looking profile and no real organization behind it.
- Reviews and testimonials that create social proof out of thin air.
- A fake expert who spends months building credibility in the right industry groups.
- A social-engineering attempt with just enough human detail to get someone to click.
None of those need a Hollywood-quality video. They only need to look normal long enough for someone to lower their guard.
What enterprises should change
The answer is not “never trust the internet.” We are all well past that, as demonstrated by the Uber we took into work.
The answer is to stop treating visual credibility as identity verification.
When the identity matters—hiring, vendor onboarding, privileged access, a payment change, a reference, a customer claim—use evidence that is harder to manufacture:
- Verified company domains and known communication channels.
- Independent employment or business-registration checks.
- Known relationships that can be validated outside the profile.
- Live interaction when the risk justifies it.
- Reputation history that is consistent across independent sources.
- Approval workflows for actions that depend on a new or changed identity.
That does not mean every LinkedIn connection needs a background investigation. It means the strength of the proof should match the consequence of being wrong.
A familiar face used to make us think, “I know this person.”
Now it should make us ask a better question:
What evidence do we have that they are who they say they are?
