Was this image made or changed by AI? A five-minute check

Short answer

Do not try to spot a fake by staring at it. In five minutes, look for a signed provenance record (a record of where the file came from and how it was edited) and an invisible watermark, find earlier copies with a reverse image search, and check the claim against a source you trust. None of these proves an image is real. Together they usually tell you whether to act.

Who this is for. Anyone sent a photo, screenshot or video that matters: a news image, a payment request, a sale listing, a claim at work. For text answers from an assistant, use Check before you trust instead.

Why your eye and detectors are not enough

In a 2022 study, 315 people sorted real faces from faces made by StyleGAN2 with 48.2% accuracy, about chance. A further 219 people, given training and feedback on each try, reached 59.0%. A third group of 223 rated the synthetic faces 7.7% more trustworthy than the real ones (Nightingale and Farid, PNAS 2022, lab study).

In a 2025 Microsoft online game, over 12,500 people made about 287,000 judgements and were right 62% of the time. They did best on portraits and worst on landscapes (Roca et al., 2025, preprint).

Detectors struggle too. On deepfakes collected from social media in 2024, open-source detectors lost about half their measured accuracy (AUC down 50% for video, 48% for audio and 45% for images) compared with older test sets. Commercial tools did better but still fell short of trained forensic analysts (Chandra et al., Deepfake-Eval-2024, preprint).

So "the hands look fine" and a detector score are weak evidence either way. The steps below look for records and context instead.

The five-minute check

Step 2: Content Credentials

Content Credentials are signed records of how a file was made and edited, built on the C2PA standard (C2PA). The Verify site takes an upload or a public URL and shows the signer, the tool and the edit history. If there is none, it says "No Content Credential" (CAI docs).

What a result means:

• A credential is present. You know which tool or device signed it. The Content Authenticity Initiative says credentials "aren't intended to prescriptively indicate whether a piece of content is 'real'", and the signer need not include an identity (CAI FAQ).
• No credential. This tells you very little. Credentials are opt-in, and C2PA notes they "can be separated" from the file. OpenAI says metadata (the hidden details saved inside a file) can be removed by platforms, editing tools or file conversions. A screenshot or a reshared copy will often have none.

Step 3: Invisible watermarks

A watermark sits in the pixels or the sound, so it can survive when metadata is stripped. Two checkers are open to the public today:

• Google SynthID. Google says it is "expanding access to everyone" for its SynthID Detector, which checks images, video and audio from Google and partners including OpenAI, NVIDIA and Kakao (Google DeepMind). In the Gemini app you can upload a file and ask whether Google AI made or changed it. Google's help page limits this to about 10 image checks in 24 hours, videos under 90 seconds and files of 100 MB or less, and says a negative result does not rule out other AI systems (Gemini Help).
• OpenAI. Images from ChatGPT, Codex and the OpenAI API (the route other programs use to reach OpenAI's models) carry both C2PA metadata and a SynthID watermark. Its verify page accepts PNG, JPG and WEBP images and some audio formats. It only finds OpenAI's signals, and OpenAI says a signal does not confirm accuracy, editing history or context (OpenAI Help; openai.com/verify).

A found watermark points to a named company's tool. No watermark rules out only the tools that checker covers, and heavy edits can remove it.

Step 4: Reverse image search

You are looking for older copies and the first context. On a computer, Google lets you upload a file, drag it onto the search box or paste an image link (Google Search Help). TinEye takes a drag-and-drop or a URL, can sort results by Oldest and by Most Changed, and shows whether modified versions exist (TinEye). Bing Visual Search takes an upload or a pasted URL (Microsoft).

What you might find (illustrative): a flood photo from another country and year, reposted as today's local news.

Step 5: Check the claim, not the pixels

Find the earliest post. Note the account, date and place. Then look for the same event on a site you trust, reached by typing its address yourself.

Step 6: Video and voice

Most of these checks do not work on a live call (for a real case, see Check the request, not the voice: payment changes at work). Use the call-back rule in Hang up and call back: end the call and reach the person on a number you already have.

Copy the checklist

Image: <WHERE_IT_CAME_FROM>   Date received: <DATE>
1. The ask: what does this want me to do? ______
2. Content Credentials (verify.contentauthenticity.org):
   [ ] signed by ______   [ ] none   [ ] unrecognized signer
3. Watermark (SynthID / openai.com/verify):
   [ ] found: ______   [ ] none found (rules out only that vendor)
4. Reverse search (Lens, TinEye sorted by Oldest, Bing):
   earliest copy: <URL> on <DATE>, caption matches? Y / N
5. Claim: first poster ______  date ______  place ______
   confirmed by a source I trust? Y / N
6. Video or voice from someone I know: called back on a saved number? Y / N
Decision: act / do not act / ask <SECOND_PERSON>

Replace the following:

• <WHERE_IT_CAME_FROM>: such as WhatsApp from an unknown number.
• <DATE>, <URL>: what you find.
• <SECOND_PERSON>: someone you will check with before a costly step.

Upload only files you are allowed to share. Do not run a private photo of someone through a public tool, and see What not to paste for the same rule with assistants.

Limits

Sources

1. Nightingale, S. J. and Farid, H. "AI-synthesized faces are indistinguishable from real faces and more trustworthy." PNAS, 2022. Lab study. Link
2. Roca, T. et al. "How good are humans at detecting AI-generated images? Learnings from an experiment." 2025. Preprint. Link
3. Chandra, N. A. et al. "Deepfake-Eval-2024." 2025, revised 2026. Preprint benchmark. Link
4. Content Authenticity Initiative. Using the Verify tool. Documentation. Link
5. Content Authenticity Initiative. FAQ. Documentation. Link
6. C2PA. FAQs. Standards body. Link
7. Google DeepMind. SynthID. Vendor page. Link
8. Google. Gemini Apps Help, checking for SynthID. Vendor help. Link
9. OpenAI. Provenance signals (Content Credentials, SynthID) in OpenAI-generated content. Vendor help. Link
10. OpenAI. Verify. Vendor tool page. Link
11. Google Search Help, search with an image. Vendor help. Link
12. TinEye. Tutorial. Vendor help. Link
13. Microsoft. Bing Visual Search. Vendor page. Link
14. FTC. Scam alerts (ReportFraud.ftc.gov). Regulator. Link
15. Report Fraud (UK). Home page. Government service. Link

Changes

1. v1.010 Oct 2026first version