Step-by-step method
A reproducible path from question to conclusion.
- 1
Preserve what you received
Keep the original file, message, address, time, apparent sender and discovery channel. Messaging recompression may remove useful information.
- 2
Find the earliest publication
Trace reposts, search for earlier versions and identify the first known account or site. An older copy may reveal different framing or caption.
- 3
Check the context
Verify location, weather, chronology, people, objects and visible events using independent dated sources.
- 4
Examine continuity
For video and audio, inspect transitions, motion, shadows, reflections, synchronisation and cuts. For images, compare edges, perspective, repetition and compression zones.
- 5
Use metadata carefully
Metadata can guide the review but may be absent, changed or stripped. Consistency supports a case; absence does not prove fabrication.
- 6
State a graded conclusion
Distinguish consistent with available evidence, probably manipulated, probably synthetic or undetermined. State limits and the next check that could change the assessment.
Provenance outweighs a single artefact
Generation and editing tools change quickly. Checklists of supposed defects become outdated and can falsely discredit authentic media.
A coherent chain of provenance, independent contemporary publications and verifiable scene details usually matter more than an opaque detector score.
Use tools as instruments, not judges
Reverse-image search, frame review, spectrograms and metadata analysis each answer a limited question. Record the result, date, tool version and tested hypothesis.
An automated score is useful only when its scope, error rate and media type are understood. Do not publish a percentage without explanation.
Avoid amplifying a false item
Do not repost the complete item merely to ask whether it is fake. Describe the concern, share the minimum necessary and keep a separate working copy.
When a person is targeted, consider harassment, defamation, fraud and privacy risk before sharing.
What to check and what to record
Use this grid to turn the method into a reviewable case file. A missing item remains an open question. The interpretation limit prevents a finding from becoming an unsupported conclusion.
| Check | Useful record | Interpretation limit |
|---|---|---|
| Origin | Received file, earliest located publisher and reposting chain. | The earliest found occurrence may not be the original. |
| Context | Claimed place and date, plus independently corroborated visible details. | Real media can be used in a false context. |
| Automated detection | Tool, version, analysed format and stated limitations. | A detector score cannot establish fabrication on its own. |
Common pitfalls
Four shortcuts that weaken the result.
Hunting for one defect
Odd details may result from compression, motion, lighting or ordinary editing.
Trusting one detector
Performance varies by model, format and transformation.
Losing the original
A screenshot often removes the file, audio and metadata needed for review.
Confusing false context with false media
Authentic media can be paired with a false date, place or caption.
Practical questions
Frequently asked questions.
Does metadata prove authenticity?
No. It may support a timeline or reveal processing, but it can be removed or changed.
Can deepfakes be spotted by eye?
Some inconsistencies may be visible, but no visible artefact proves nothing. Provenance and corroboration remain essential.
Should a detector score be published?
Only with its context, limitations and other evidence. An isolated percentage can mislead.
Editorial scope
Published by Internet Intelligence Service on 15 September 2026. Last content update: 6 October 2026. This educational guide describes a lawful, defensive method. It is not legal advice, an emergency service or authority instruction.