Spotting a synthetic image is now a control question, not a party trick. The picture in the email is the damage claim. The portrait on the job application is the new hire. The screenshot is the exhibit. When any of those turns out to be synthetic, the cost lands on whoever accepted it without asking. This guide sets out what anyone on your team can check in a few minutes, where those checks stop being reliable, what a forensic examiner does that a web tool cannot, and how to write the whole thing into a procedure that survives a dispute.
Petronella Technology Group, Inc. has run digital forensics engagements for law firms and insurers, and for regulated businesses, from Raleigh, North Carolina since 2002. Craig Petronella holds a North Carolina Digital Forensic Examiner license, 604180-DFE. That background shapes this guide to how to tell if a photo is AI-generated, and it shapes the honest version: no single check settles the question and several checks together often narrow it. What holds up, when someone has to defend an answer on the record, is a properly documented examination.
How to tell if a photo is AI-generated: the four checks anyone can run
Most disputes never need more than the first layer. These checks cost nothing and take minutes, and their limits are known, which is what makes them useful.
1. Read the Content Credentials, if there are any
Content Credentials are the C2PA standard: a cryptographically signed record of who made or changed a file and how. The specification describes it as a model for storing cryptographically verifiable information "whose trustworthiness can be assessed based on a defined trust model", with each set of assertions wrapped into a digitally signed claim. Practically, you load the file into a viewer and read what comes back.
The free public viewer is at verify.contentauthenticity.org. Google also surfaces the same information in Search: if an image carries C2PA metadata, the "About this image" panel in Google Images, Lens and Circle to Search will show whether the image was created or edited with AI tools.
Two things to understand before you rely on this. First, a validated credential is strong evidence that a particular signer recorded a particular set of steps. It is not evidence that the scene is true, and the framework is clear that provenance is a trust signal for a human to weigh, not a verdict. Second, the project itself says plainly that "Content Credentials metadata is cryptographically secure but easily stripped", and that it is still common for platforms to remove metadata. The industry answer to stripping is durable credentials, which pair metadata with an invisible watermark and a signed image fingerprint. Adoption is uneven, so you cannot assume any given file carries that protection. Any company that receives images as evidence should assume the credentials are gone unless a viewer loads them.
2. Check the watermark, if the tool that made it watermarks
Google's SynthID adds an invisible watermark at the moment of generation, and Google states it is designed to stand up to cropping and filters. It is also built to survive frame rate changes and lossy compression. The SynthID Detector is public at synthid.com and, per Google's announcement, covers content from Google, OpenAI, NVIDIA, Kakao and Apple, among others.
The limit is structural, not technical. A watermark only exists if the generator applied one. It identifies the pipeline that produced the file. It says nothing about an image produced by an unwatermarked tool, and it says nothing about whether the depicted event happened.
3. Read the metadata, knowing it can be edited by anyone
Exchangeable image file data and the newer IPTC fields record the camera model and the capture settings. They also name the software and, sometimes, a source-type label. The IPTC Digital Source Type vocabulary is the most useful of those labels because it distinguishes cases a business actually cares about: digitalCapture for a real capture, trainedAlgorithmicMedia for content created using generative AI, compositeWithTrainedAlgorithmicMedia for an image edited with generative AI, and separate terms for composites that mix captured and synthetic elements.
ExifTool is the standard free tool for reading this, and its own documentation carries the warning that matters: "ExifTool is not guaranteed to remove metadata completely from a file when attempting to delete all metadata." Read that in both directions. Metadata can be faked by anyone who wants to, and it can be incompletely removed by anyone who wants to hide something. Treat a present, internally consistent label as one weak positive signal. Treat an absent label as nothing at all.
4. Reverse image search for earlier appearances
Search engines and dedicated services index where an image has appeared before. That is genuinely useful for a specific question: has this exact picture been published somewhere else, earlier, by someone else, possibly under a different caption? A catalog photo resent as claimed damage, or a stock portrait reused across several fake profiles, usually surfaces this way.
What it cannot do is authenticate. Finding no earlier appearance proves only that you did not find one. Finding an earlier appearance proves the image existed before, not that it was real then. And a determined fabricator working from a newly generated image will have nothing to find.
Why an AI image detector cannot settle it
The file carries four kinds of information.
- Provenance records.
- Watermarks.
- Descriptive metadata.
- The compression and noise signature of its own history.
Each answers a different question, and none of them answers "is this scene real". The tools that try to answer it in one binary score are the least dependable part of that stack, and they are the part most vendors describe with a single accuracy number.
Detector tools output a probability that has been thresholded into a binary answer, and both possible errors have real costs: a false positive accuses a real photograph, a false negative waves a fake through. Published testing shows both errors at rates no business process should treat as authoritative.
The false positive problem, measured
NewsGuard tested five leading consumer tools in late April and early May 2026 against 15 authentic news photographs from Reuters, the Associated Press, the New York Times, the Guardian and Google Earth, then against 15 lightly edited and 15 heavily edited versions. The tools collectively declared authentic images to be AI-generated 13.33 percent of the time. One vendor's tool got it wrong on 6 of 15 real images, a 40 percent error rate. Another wrongly flagged 3 of 15. Two tools correctly cleared all 15 authentic images, and one of that pair then caught only 5 of the 15 heavily altered images.
The vendor explanations are the useful part, because they name mechanisms your own cases will hit. One co-founder said detectors generally require high resolution and high pixel levels. Another said resizing and compression can cause real images to be incorrectly flagged, and that images with unusual lighting or high contrast are prone to it, along with blur, noting that conflict-zone news photos often carry several of those qualities. Every one of those conditions is present in a phone photo of a dented bumper taken at night and sent through a messaging app.
The false negative problem, measured
The same audit found detection of significantly altered images ranged from 33 percent to 100 percent depending on the tool. The weakest tool caught 5 of 15. That is the number that matters when someone submits a genuinely doctored claim.
Independent benchmarks are harsher. Deepfake-Eval-2024 evaluated detectors against deepfakes that circulated in the wild in 2024, drawn from 88 websites in 52 languages, and found open-source state-of-the-art models' performance dropped precipitously, with AUC decreasing by 50 percent for video, 48 percent for audio and 45 percent for image models compared with the academic benchmarks the same models were tuned on. A separate 2025 benchmark built on the Political Deepfakes Incident Database found academic and government detectors reached a maximum AUC of only 74.78 percent on images and 73.67 percent on video, and that some vendors advertise more than 98 or 99 percent accuracy while four of the tools tested scored below 65 percent.
The commercial picture is uneven rather than bad. In that same benchmark, one commercial tool reached 93.51 percent accuracy on images and another 91.07 percent with a false acceptance rate of 2.56 percent, while a third returned an AUC of 39.34 percent. At video level every tool tested dropped, and the highest video AUC came with a false acceptance rate of 65.96 percent, meaning it flagged real video as fake most of the time. Earlier, Meta's Deepfake Detection Challenge saw its winning entry reach 65.18 percent average precision against a dataset the entrants had never seen.
NIST's 2024 report on synthetic content is candid about the state of the field: the efficacy of many of these technical approaches "are not fully examined yet", most are years from widespread deployment, and there is "no perfect solution". That is the federal standards body, not a competitor.
Why the models fail this way
Detectors learn the artifacts of the generators they were trained on. New architectures produce new artifacts, compression destroys old ones, and a phone screenshot destroys nearly all of them. Add adversarial pressure, since anyone motivated can iterate against a published detector, and you get the measured pattern: good numbers on clean academic data, thin numbers on what actually arrives in your inbox. The practical rule is that a detector score is a lead-generation signal for a human review, never a decision.
Real photos get accused too, and that has a cost
The false positive side is not an abstraction, and the cost lands on the person who is right. The National Center for State Courts has documented what it calls "the deepfake defense", where the sheer availability of convincing fakes lets a party dismiss a genuine recording as fabricated. A detector that agrees gives that argument a respectable-looking basis. Every business that adopts a detector as a gate should decide in advance what happens when the tool is wrong about a real claimant, because that outcome is the expensive one in reputational and legal terms, and it is the one no vendor's accuracy claim covers.
When the question needs a forensic examiner
There is a line worth drawing clearly, and it is not about how impressive the fake looks. It is about consequences.
Engage an examiner when money, employment, liberty or a formal claim turns on the answer, when the file may become evidence, when the other side has its own expert, or when someone's conduct is being decided on the strength of an image. In those settings a detector score is not defensible, because it cannot be interrogated and it cannot be calibrated against your case. Nor can it be explained to a judge by the person who ran it.
What an examiner does instead follows a documented method. The SWGDE best practices for image authentication define the task as determining whether imagery is "a true and accurate representation of subjects and events", and they are equally clear about the boundaries. Image authentication does not answer what happened. It does not say whether a specific object was present, and it does not say where a scene is located. It is a separate discipline from proving integrity: a hash proves a copy is identical to the file it came from and, in SWGDE's words, "cannot demonstrate the veracity of the scene depicted in the image".
In practice an examination considers the file structure and the compression and noise behavior across the image. It looks at inconsistent features between regions and at whether reference material is available, then states a conclusion with its reasoning and its limits attached. SWGDE is explicit that results are limited by the quality and quantity of the imagery, that it is possible an examination cannot be completed at all, and that practitioners must take care not to overstate results. It also requires attention to cognitive bias. Confirmation bias and contextual bias are named as sources of uncertainty to be controlled through limited task-irrelevant information and blind verification.
That matters for a business audience in a specific way: a good examiner will sometimes tell you the file cannot answer your question, and that answer is more valuable than a confident one you cannot defend. Our own practice documents the chain-of-custody side of this, with write-blocked acquisition, MD5 and SHA-256 hash baselining at collection, tools validated against the NIST Computer Forensics Tool Testing program, and all analysis performed on copies rather than originals. You can see how that is structured on the digital forensics and incident response page, in the walk-through of how an engagement runs, and in the attorney engagement packet.
The examination itself is a defined discipline, not a series of clever tricks. Our AI image forensics page sets out what an examination of a questioned photograph covers. That includes the evidence classes above and how a conclusion is stated. It also says where the work stops because the file cannot answer the question. Read it before you brief an examiner, so the scope conversation is about the decision you need to make rather than the tools you have heard of.
Courts are already working through the consequences. In Mendones v. Cushman and Wakefield, a California superior court judge found that a terminating sanction was appropriate after concluding several plaintiff exhibits were deepfake videos and images, describing one photograph as materially altered on grounds including a mismatch in lighting and contrast between a figure and its Ring camera background. The judge also cited a mismatch in color and sharpness. The National Center for State Courts describes it as one of the first instances of a deepfake submitted as authentic evidence and detected as such.
Deepfake fraud scenarios in business, with the reported cases
Image fraud rarely arrives alone. It arrives with a voice, a plausible account, and a deadline. These are reported cases, not hypotheticals.
Payment fraud
In January 2024 a finance employee in Hong Kong transferred about 25 million dollars after a video conference in which the chief financial officer and several colleagues were deepfake recreations. The employee had initially suspected a phishing email, then dropped the doubt after seeing and hearing recognizable people on the call. Arup later confirmed that fake voices and images were used and that it had notified Hong Kong police. The amount remitted was HK$200 million, about 25.6 million US dollars.
Not every attempt succeeds, and the successful defenses are instructive. In May 2024 fraudsters created a WhatsApp account in the name of WPP chief executive Mark Read using a publicly available photograph. They then set up a Microsoft Teams meeting and used a voice clone along with public YouTube footage of another executive, impersonating Read off camera through the chat window. Read told colleagues the attackers "were not successful".
In July 2024 a Ferrari executive received WhatsApp messages that appeared to come from chief executive Benedetto Vigna about an acquisition requiring an urgent non-disclosure agreement. The voice on a follow-up call mimicked Vigna's accent but the tone was inconsistent, so the executive asked the caller the title of a book Vigna had recommended days earlier. The caller could not answer and ended the call. One question, known only to a real person, defeated the imitation.
Insurance and claims fraud
The UK insurer Admiral reported in April 2026 that it recorded a 71 percent rise in fraud during 2025 compared with the previous year, partly attributing it to the increased use of AI software to manipulate evidence. Its published examples include an AI-generated number plate applied to a damaged Land Rover, with a similar image carrying a different number plate used in a duplicate claim, an AI-generated image of a gold and diamond watch, and AI-exaggerated damage to a vehicle.
For anyone running claims, the pattern to notice is that the fake is often a competent edit to a real photograph rather than a wholly synthetic image. That is the case designed to defeat a visual check and to defeat a detector trained on whole-image generation.
Hiring fraud
The FBI's Internet Crime Complaint Center warned in 2022 that deepfakes combined with stolen personal information were being used to apply for remote positions, in information technology and programming, including database and software roles. Some of those roles came with access to customer data and financial records, as well as proprietary systems. Complaints described voice spoofing or likely voice deepfakes in online interviews. There the actions seen on camera and the lip movement failed to align with the audio, and a cough, or a similar sound, did not match the video.
The Center's 2025 annual report records more than 22,000 AI-related complaints with adjusted losses above 893 million dollars, including nearly 13 million dollars in AI-involved employment scams and more than 30 million dollars in business email compromise losses involving AI. In employment cases the report notes the dollar loss is usually not the point: the goal is network access.
HR, insurers and legal teams: where the exposure sits
Each of these functions has a different failure mode, and the fix differs accordingly.
Image and video evidence in HR and hiring usually supports an identity claim. Treat an interview as an identity event, not a conversation. Verify against an independent document channel. Ask questions whose answers are not searchable. Check that the audio and video behave as a single physical event. A candidate who cannot answer an un-Googleable question about their own claimed history is a bigger signal than any detector score.
For insurers and claims teams, the exposure is symmetrical. A missed fake pays a fraudulent claim. A false positive denies a legitimate one and invites a bad-faith allegation. The proportionate control is to route suspect files to examination, not to reject on a tool output, and to require the original file rather than a forwarded or screenshot version because most examination value dies in re-encoding.
For legal teams, two disciplines are often confused. Authenticity of the copy is a chain-of-custody and hashing question, and Rule 902(14) of the Federal Rules of Evidence allows self-authentication of data copied from an electronic device when authenticated by a process of digital identification, with the Committee Note explaining that identical hash values reliably attest to exact duplication. Authenticity of the scene is a different question entirely, and a hash answers none of it. A file can be perfectly preserved and still depict something that never happened.
Across all three, one habit prevents most of the damage: preserve first. The examiner cannot examine what has been forwarded through three messaging apps and re-saved.
What is changing in the rules, and what it means for intake
Two regulatory developments matter to how you document a disputed image, and neither of them changes the technical picture above. They change who is expected to have labeled something, which is a useful tie-breaker when provenance is silent.
In the European Union, Article 50 of the AI Act sets transparency obligations that apply from 2 August 2026. Deployers who create deepfakes must disclose it, with a reduced obligation for work that is evidently artistic or creative. That reduction also covers satirical or fictional work applied in a manner that does not hamper enjoyment of it. No obligation applies where the law authorizes the use to detect crime or to prevent crime, or to investigate and prosecute it. Providers of generative systems also face machine-readable marking duties. The European Commission's AI Act pages carry the current timeline and the code of practice for AI-generated content. If you trade into the EU, disclosure becomes the default and an undisclosed deepfake starts from a worse position.
In the United States, 16 CFR Part 461 is the FTC's Rule on Impersonation of Government and Businesses. Under that rule it is an unfair or deceptive act to impersonate a business or a government entity, or to misrepresent affiliation with one. A deepfaked executive asking for a wire is squarely inside that rule, which is why documenting the request matters, as do the channel and the artifact: it converts a loss into evidence of a defined deceptive practice.
For practical purposes, intake is where these obligations become real. A vendor that sends an AI-generated before-and-after photograph without disclosure has handed you a compliance fact you can use. A claimant who discloses augmentation up front under the IPTC vocabulary has given you something a detector never will: a statement you can hold them to.
A checklist you can adopt as policy
Print this, or copy it into your incident and claims procedures. It is ordered by cost, cheapest first.
- Preserve the original. Save the file exactly as received, before opening, forwarding, screenshotting or re-saving. Record who received it, when, from what address or number, and compute a hash at that moment.
- Ask for the original, not a copy. Request the source file from the sender, or the device, and note any refusal. A refusal to produce an original is itself information.
- Run the cheap checks and write down the result. Content Credentials in a viewer, SynthID if the file is image or video from a supported generator, the EXIF and IPTC source type, and a reverse image search. Record the tool, the date and the exact output, including "nothing found".
- Do not treat a detector score as a decision. If you use one at all, use it to triage, record the vendor and version, and state the known error rates when you report it.
- Set a materiality threshold. Define in advance which matters go to an examiner: any payment decision, any employment decision, any litigation exhibit, any claim above a stated value, any matter where the other side has an expert.
- Engage the examiner before the file degrades. Give them the original, the chain of custody, and the questions you actually need answered. Expect a written scope that says what can and cannot be determined.
- Require a stated confidence and its limits. A report that gives an opinion without its basis, method and limitations is not usable in a dispute. The SWGDE best practices direct the practitioner not to overstate results, and your engagement letter should require the same.
- Separate integrity from veracity in every report you write internally. "We preserved this file without alteration" and "this depicts what it appears to depict" are two sentences that must never be merged.
- Feed the outcome back into the control. If a fake got through, the gap is in intake, not in the detector.
Related reading
- AI Receipts: How C2PA Watermarks Shield Enterprise
- HIPAA Photo Violations: Rules Every Practice Must Know
- Brand Trust in a Deepfake World: C2PA and Watermarks
- Blockchain Receipts for AI Returns Protect Privacy
FAQ
Can I tell if a photo is AI-generated just by looking at it?
Not reliably. In a study of roughly 287,000 image judgments by more than 12,500 people, participants identified real versus AI-generated images correctly only 62 percent of the time. People did best on human portraits and worst on natural and urban landscapes, which is exactly the material that shows up in insurance claims and property disputes.
What are Content Credentials and how do I check them?
Content Credentials are the C2PA standard for signed, machine-readable provenance attached to a file. You check them by loading the file into a viewer such as verify.contentauthenticity.org, or by using the About this image panel in Google Images, Lens and Circle to Search when C2PA metadata is present. A credential that validates tells you who signed it and what edits were recorded. It does not tell you the scene is true, and the project itself notes the metadata is easy to strip.
Does a missing Content Credential mean the photo is fake?
No. Most cameras and phones in use today do not write Content Credentials at all, and neither does most software. Social platforms commonly remove metadata on upload. Absence of provenance is the normal state of a real photograph taken on an ordinary phone. Only a validated credential is evidence of anything.
How accurate are commercial AI image detectors?
Measured accuracy varies widely and cuts both ways. A 2026 NewsGuard audit found five leading tools collectively called authentic news photos AI-generated 13.33 percent of the time, with one tool wrong on 40 percent of real images, while the same tools missed between 0 and 67 percent of heavily altered images. A benchmark of real political deepfakes found academic and government detectors topped out at 74.78 percent AUC on images, and named vendors advertising 98 or 99 percent accuracy while four tested tools scored below 65 percent.
What can a forensic examiner do that a detector cannot?
An examiner works to a documented method rather than a binary score. Under the SWGDE best practices for image authentication that means examining the file structure and the compression and noise behavior. It also means examining inconsistent features and any available reference material, then stating the conclusion with its limits and the reasons behind it. The examiner can also preserve the file by hash and keep a chain of custody, and can defend the work under cross-examination. SWGDE is explicit that some examinations cannot be completed and that practitioners must not overstate results.
Can a real photo be falsely accused of being AI-generated?
Yes, and it already happens. Detector vendors told NewsGuard that resizing and compression can cause real images to be flagged, and that the same happens with unusual lighting and high contrast. They added that conflict-zone news photos carry several of those qualities. A false positive can cost a claimant a legitimate payout or expose a publisher to a fabricated claim that its real photograph was fake.
Where does deepfake fraud actually cost businesses money?
Losses concentrate on payment authorization, on hiring and on claims. A finance employee at Arup wired about 25 million dollars after a video conference in which the CFO and colleagues were deepfake recreations. The FBI reports more than 22,000 AI-related complaints and over 893 million dollars in adjusted losses for 2025, including more than 30 million dollars in business email compromise losses involving AI. Insurer Admiral recorded a 71 percent rise in fraud in 2025, partly blaming AI-manipulated claim evidence.
What should a company do first when a photo is disputed?
Preserve the original file before anyone forwards, screenshots or re-saves it. Send the untouched file rather than a copy pasted into chat, and record a hash at the moment of receipt. Then run the cheap checks and document what they returned. If money, employment, litigation or an insurance claim depends on the answer, engage an examiner rather than relying on a detector score.
Next step
If a disputed image is already in front of you, the order of operations is the whole game: preserve, then check cheaply, then escalate on materiality. The forensics practice handles engagements that need a documented method, chain of custody and a report you can put in front of counsel, and the law-firm page covers expert-witness work on matters the team investigates personally. For the broader picture of how private and regulated organizations should be using AI rather than being surprised by it, start at the AI hub. Compliance teams mapping this into a control set can find the framework questions on the compliance pages, and the services overview describes how a scoped engagement is put together.
Call Penny at 919-348-4912 for a direct conversation about a live matter, or contact the team online and describe the file and the deadline, along with what decision depends on it. Bring the original file if you still have it. That single habit decides more cases than any detector ever will.
Sources
- Content Credentials : C2PA Technical Specification :: C2PA Specifications (spec.c2pa.org)
- Content Credentials (verify.contentauthenticity.org)
- How Google and the C2PA are increasing transparency for gen AI content (blog.google)
- Three pillars of provenance that make up durable Content Credentials (contentauthenticity.org)
- SynthID, Google DeepMind (deepmind.google)
- SynthID Detector (synthid.com)
- Google expands SynthID Detector for AI content (blog.google)
- Digital Source Type controlled vocabulary, IPTC (cv.iptc.org)
- ExifTool by Phil Harvey (exiftool.org)
- Leading AI Image Detection Tools Mislead Online Users, Often Declaring Authentic Content Fake - NewsGuard (newsguardtech.com)
- [2503.02857] Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024 (arxiv.org)
- [2510.16556] Fit for Purpose? Deepfake Detection in the Real World (arxiv.org)
- Deepfake Detection Challenge (DFDC) dataset, Meta AI (ai.meta.com)
- Reducing Risks Posed by Synthetic Content An Overview of Technical Approaches to Digital Content Transparency (nist.gov)
- AI-generated evidence is a threat to public trust in the courts (ncsc.org)
- Best Practices for Image Authentication - SWGDE (swgde.org)
- Deepfake Videos and Images Lead to Terminating Sanctions (ediscoverytoday.com)
- Finance worker pays out $25 million after video call with deepfake ‘chief financial officer' (cnn.com)
- CEO of world's biggest ad firm targeted by deepfake scam (theguardian.com)
- How Ferrari Hit the Brakes on a Deepfake CEO (sloanreview.mit.edu)
- AI-generated images behind increase in insurance fraud (bbc.com)
- Internet Crime Complaint Center (IC3) (ic3.gov)
- FBI Internet Crime Complaint Center 2025 Internet Crime Report (ic3.gov)
- Rule 902. Evidence That Is Self-Authenticating (law.cornell.edu)
- Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems (artificialintelligenceact.eu)
- AI Act | Shaping Europe's digital future (digital-strategy.ec.europa.eu)
- 16 CFR Part 461 - RULE ON IMPERSONATION OF GOVERNMENT AND BUSINESSES (law.cornell.edu)
- [2507.18640] How good are humans at detecting AI-generated images? Learnings from an experiment (arxiv.org)
Reference build sheets, a hardening checklist for open-weight model hosting and a data-sovereignty map for running AI on your own hardware.
Get the free guide
