How to Spot AI-Generated Images and Deepfakes: A Step-by-Step Guide

There is no single foolproof test for telling a real photograph from an AI-generated one. Instead, researchers and fact-checking organisations recommend layering several checks — visual inspection, metadata, provenance data and reverse image search — because each method catches different kinds of fakes and each can be fooled on its own.

Step 1: Look closely at the image itself

Cybersecurity firm ESET recommends starting with a close visual read of the image. Warning signs include unnatural lighting, overly smooth skin textures, flickering or blurred edges around a subject, misaligned eyes, distorted teeth and unusual blinking patterns in video. For video with sound, check whether the audio matches the mouth movements, since mismatches are a common deepfake tell, ESET says.

Step 2: Check the metadata

ESET advises reviewing a file's metadata, including creation and modification dates, because deepfake tools frequently strip or alter this information, which can create inconsistencies worth noting. The absence of expected camera or device information, or the presence of AI-editing software names in the file data, can be a clue, though metadata can also be removed or faked and should not be treated as definitive on its own.

Step 3: Use reverse image search

Running the image through a reverse image search tool such as Google Images or TinEye can reveal whether the picture has appeared elsewhere online, in what context, and when — helping to confirm whether it is an old photo being recirculated with a false claim or a genuinely new image, ESET notes.

Step 4: Check for Content Credentials or watermarks

The Content Authenticity Initiative (CAI), the group behind the C2PA standard, describes Content Credentials as a kind of "nutrition label" for digital content: cryptographically signed metadata that can record who created an image, when, with what tools, and whether AI was involved. The credentials are tamper-evident — if the image or its attached data is altered after signing, the Content Credentials will flag that change, according to the CAI.

However, the CAI is explicit about the limits: Content Credentials do not declare that content is fake or altered, and they rely on the creating tool having added the credentials in the first place. An AI image made with a tool that does not support C2PA will carry no such label at all.

Google DeepMind's SynthID works differently: it embeds an invisible digital watermark directly into an image's pixels when the image is made with Google's Imagen model. Google says the watermark survives common edits such as filters, colour changes, compression and brightness adjustments, and a detection tool returns one of three results — "detected," "not detected" or "possibly detected." SynthID's watermark only works on images produced by Google's own models; it cannot identify content made by other generators such as Midjourney or Stable Diffusion, according to DeepMind.

Step 5: Treat automated detector tools with caution

An evaluation by researchers at the organisation WITNESS, published by the Reuters Institute for the Study of Journalism in April 2024, examined tests carried out in February 2024 on eight publicly available deepfake detectors — Optic, Hive Moderation, V7, Invid, Deepware Scanner, Illuminarty, DeepID and an open-source AI image detector. It found that detection tools perform only as well as the data they were trained on: a detector trained to recognise AI-generated images could fail on face-swap deepfakes, and tools trained mainly on well-known public figures such as Volodymyr Zelenskyy struggled with less famous people.

The same evaluation found that simple edits could defeat detectors. Cropping, compressing or lowering the resolution of an image caused some tools to misclassify synthetic content as real; after the resolution of a well-known Obama deepfake video was reduced and part of the clip edited out, a detector returned a result of "No Deepfake Detected." Screenshots of AI-generated avatars were also frequently misclassified as human-made, the evaluation found.

Putting it together

1. Inspect the image closely for lighting, texture, eye, hand and background inconsistencies.
2. Check available metadata (camera model, dates, software) for anomalies.
3. Run a reverse image search to see where and when the image first appeared.
4. Look for Content Credentials (C2PA) or a SynthID watermark where applicable, understanding neither covers every AI tool.
5. If using an automated detector, treat its result as one input among several, not a final verdict — WITNESS researchers note such tools work best alongside other techniques such as reverse image search and geolocation, not as a stand-alone solution.
6. Cross-check the claim attached to the image against reputable news organisations or fact-checking sites.

No method on this list is sufficient by itself. The CAI, ESET and the WITNESS/Reuters Institute evaluation all converge on the same conclusion: provenance data, watermarks and automated detectors each cover only part of the problem, and combining several checks — plus ordinary scepticism about where an image came from and who is sharing it — remains the most reliable approach available today.