How to Respond to Fake Official Media During a Crisis

How fake official media spreads during a crisis

Fake official media is content that pretends to come from a government, emergency service, company or news outlet: a video statement from a leader, an evacuation notice, a press release, a photo of an attack or a full copy of a news website. It spreads fastest in the first hours of a crisis, when people want information and official channels have not yet said much.

The formats range from cheap to sophisticated. Old photos are relabelled as today's disaster, AI image generators produce plausible explosions or floods in seconds, voice clones read fake emergency announcements, and face-swapped videos show leaders saying things they never said. Coordinated campaigns add lookalike domains and networks of accounts to make the fake appear widely reported.

Three cases that show the pattern

War: on 16 March 2022, a video showing a rendering of Ukrainian President Volodymyr Zelenskyy telling soldiers to lay down their arms circulated on social media and was placed on a Ukrainian news website by hackers, NPR reported. It was debunked and removed the same day.

Markets: on 22 May 2023, an image purporting to show an explosion near the Pentagon spread widely on social media and sent a brief shiver through the stock market, AP reported. Police and fire officials in Arlington, Virginia, said the image was not real and there was no incident. The image needed no video or voice to move money.

Impersonated news brands: on 4 September 2024, the US Justice Department announced the seizure of 32 internet domains used by the Russian influence operation known as Doppelganger. According to The Record, one seized domain, washingtonpost.pm, was built to look like The Washington Post and carried only stories criticising Ukraine's leaders and US policy, and internal documents described using AI-generated content and video in the Fox News style.

Fake official media crisis response: the first hour

The first hour decides how far a fake travels. Confirm first: ask the person or office depicted, through a contact you already hold, whether the statement is real. Then publish a short, plain correction on every channel you control, saying what is false, what is true and where people should look for updates. Pin it, and repeat it in the same formats the fake used, such as a short video if the fake was a video.

In parallel, preserve the fake: save copies of the file, URLs, account names, timestamps and screenshots of how it is being shared. Report it to the main platforms through their crisis or impersonation routes, and alert partners, such as emergency services, regulators and newsrooms, so they do not repeat it.

Avoid repeating the fake in full when you correct it. Describe the claim in one line, show a still with a clear label if an image is needed, and lead with the accurate information. Corrections that embed the original video often spread the fake further than the denial, especially when they are clipped and reshared without the label.

• Confirm with the depicted person or office through a known contact.
• Publish a short correction on all verified channels and pin it.
• Preserve files, URLs, accounts and timestamps before they disappear.
• Report to platforms and domain registrars under impersonation or crisis policies.
• Brief partners and journalists directly so they can correct quickly.

Preparing before the next crisis

Organizations that respond well prepare in calm periods. Keep a published list of official channels so the public knows where real statements appear. Pre-agree who can approve a denial at night and at weekends, and draft holding statements for likely scenarios such as a fake evacuation order, a fake executive video or a spoofed press release.

Register obvious lookalike domains, monitor for new ones that copy your brand, and consider signing official media with Content Credentials so authentic statements carry verifiable provenance. Provenance does not stop fakes, but it gives journalists and platforms a quick way to confirm what is real.

Where detection helps a crisis team and where it does not

Detection is most useful when the depicted person cannot quickly confirm or deny, when a fake is good enough that journalists hesitate, or when a correction will be challenged. A documented analysis showing synthetic regions or manipulated audio gives newsrooms and platforms something concrete to cite.

Neural Defend's NeuroDetect supports that work. Communications, security or newsroom teams upload the authorized image, video or audio into a case and review heatmaps and attention views down to regions, frames and audio segments, alongside a plain-language summary linked to the evidence. The downloadable forensic report records observations, uncertainty, provenance and model context, and the analyst makes the final call. The models come from ARCAS 1B, whose paper reports pooled accuracy of 99.92% on WildFake and 97.65% on OpenFake.

Detection cannot confirm that an event did or did not happen, and it will correctly find nothing synthetic in a real photo from a different disaster. Context checks and the depicted authority's word remain the core of the response.

State influence operations and election periods

Influence operations linked to states use the same tools at larger scale and over longer periods. Doppelganger combined cloned news sites, paid influencers and social media advertising, according to US court documents summarised by The Record. Such campaigns time their output to elections, wars and natural disasters, when public attention is high.

Election offices, ministries and large companies should treat these periods as heightened risk: increase monitoring, shorten approval chains for corrections and agree contacts at platforms in advance. The election communications workflow on this site covers that scenario step by step.