Yuval Noah Harari was sent a 30-minute lecture he never gave. It took him, the person being impersonated, a minute and a half to be sure it wasn't him: "A couple of people sent me the same video, 30 minutes long lecture that I supposedly gave about the future." "And with complaints about you said this and you said that, and I kind of scratched my head. I don't remember saying these things." "So they sent me the video and I opened it and it took me a minute and a half, a minute and a half to conclude this isn't me." "My sisters know me for 50 years and they felt something was off, but they weren't sure. They said, is this you?" This is Harari's own account, told to The Economist in an interview published on August 22, 2026. He adds the caveat himself: he is in an exposed position because so much of him is already online. Ninety seconds is the part worth keeping. Not because it is slow, but because of who was doing the checking. Harari had every advantage available. He knows his own views, his own voice, his own speaking habits, and he knew something was wrong before he pressed play, because the people sending it were complaining about things he had never said. He still had to sit and evaluate it. His sisters had the second-best prior in the world, 50 years of knowing him, and they could not resolve it at all. They felt something was off and escalated to the source. The practical warning is that recognizing a fake of someone you know is not sufficient by itself. Recognition is doing far less work than we assume. What actually settled this was not a sharper eye. It was checking with the person. That is the practical lesson, and it scales past deepfakes. As AI output gets cheaper to produce, the expensive step moves to verification, and verification is a process, not an instinct. If your organization's control for a fraudulent instruction is that someone will notice, you do not have a control. You need a channel that confirms through a second route: a known number, a separate system, a person you call back. Build the callback before you need it. Harari's sisters had one; the operational lesson is to make that second route explicit before a real instruction depends on it.