AI or Not? How to Detect Deepfakes and AI-Generated Content

AI or Not? Start With the Source

An unfamiliar profile photo, an urgent request during a video call, or a recording shared without context can raise the same question: is this real, or was it generated by AI? For a website owner, a hiring team, or someone reviewing customer-submitted content, the useful next step is to check the evidence before acting.

AI-generated content is not automatically deceptive. It can be used openly for illustration, translation, accessibility, or entertainment. A deepfake typically uses AI to imitate or alter a person's appearance or voice. Other misleading content may need no AI at all: an old recording presented as live, a real photograph with a false caption, or a screen replay used at login.

To investigate, combine the source and context with available file information and relevant detection tools. A realistic appearance is not proof of authenticity, and a suspicious detail is not proof of a deepfake. The right approach depends on whether you are reviewing a file, joining a live meeting, or authenticating a user.

How to Check Images and Videos for AI Generation

Start with a short, repeatable review rather than a list of supposed visual giveaways. Keep the original file where you have permission to do so, and record which observations need further checking.

• Find the original source. Who published or supplied the media? Ask for the original file or recording rather than relying only on a screenshot or forwarded clip. Check whether the claimed event, location, and date are supported elsewhere.
• Inspect the sequence, not just one frame. Watch the surrounding footage and compare moments where the face, lighting, or camera angle changes. Unusual movement or mismatched audio can warrant a closer look, but compression, editing, and connection problems can also affect the result.
• Review available metadata and provenance. Capture dates, editing-software tags, and Content Credentials may provide context. Missing information does not establish that a file is AI-generated, and recorded metadata can be incomplete or altered.
• Use detection results as supporting evidence. Check what the tool actually assessed: an image, a selected frame, a face capture, or a visible meeting participant. Do not extend a result beyond that scope.
• Confirm the important claim separately. Before approving a payment, changing account access, or accepting sensitive instructions, use an established contact channel or your organization's approval process.

Provenance and automated detection answer different questions. One examines a file's recorded history; the other looks for signals associated with generation or manipulation. NIST's overview of synthetic-content transparency discusses these approaches and their limitations. Neither should be treated as a universal authenticity test.

How to Tell Whether an Image Is AI-Generated

Begin with what the image is being used to claim. A profile picture, a product photograph, and a screenshot of a conversation need different checks. You may need to establish where a photograph came from, whether it has been altered, or whether it supports the accompanying story. Those are separate questions from whether AI was involved.

Inspect Details Without Relying on Visual Shortcuts

Look at the full image first, then inspect areas relevant to the claim: a face, a badge, a product label, or text on a sign. Note inconsistent details rather than immediately assigning a cause. For example, an unreadable company logo may justify asking for the original photograph, but it does not tell you whether the problem came from generation, editing, resizing, or an ordinary low-quality upload.

Avoid rules such as “normal hands mean it is real” or “strange eyes mean it is AI.” A convincing image can still be synthetic, and an authentic photograph can contain unusual details. Treat visual inspection as a way to identify questions for the next stage.

Faces, Hairlines, Glasses, and Small Features

Inspect the transition between the face and its surroundings, not just the center of the face. Look around the jaw, ears, hairline, glasses, and facial hair for abrupt changes in sharpness, color, or texture. In video, compare the same boundary as the person turns or an object passes in front of it. A detail that changes unexpectedly across several frames is more useful to investigate than a single soft edge in a compressed image.

Write down what you see: “The glasses frame disappears beside the right cheek during the turn” is a usable observation. “The person looks artificial” is not. MIT's Detect Fakes research project discusses facial details as possible inspection cues, while emphasizing that high-quality manipulations can be difficult to distinguish.

Lighting, Shadows, and Reflections

Compare the lighting on the subject with nearby surfaces. Does a product cast a shadow where it meets the table? Does a reflection remain consistent when the object moves? Does the face change brightness with the rest of the scene? Start with relationships between objects you can actually see; a photograph rarely shows every lamp, window, or reflective surface affecting it.

For example, a supplier photo may show a package beside a reflective monitor. If the reflection appears to contain a different package, request another view or the original file. The discrepancy could justify further investigation without proving how the image was created. Avoid simple claims that all shadows must point in one direction or that every reflection must be equally bright.

Object Structure, Perspective, and Contact Points

Follow an object's structure through the image: a cable to its connector, a handle to its attachment, or a shelf edge behind an item. Look for connections that disappear, surfaces that merge, or shapes that change without a visible reason. In a product demonstration, check whether the same controls and ports remain in place across different views.

Perspective needs careful interpretation. Parallel edges can appear to converge in a photograph, and a wide-angle lens can bend straight lines near the frame boundary. Rather than declaring a perspective error from a screenshot, identify the exact feature and compare another view of the same object.

Text, Labels, and Repeated Details

Read visible labels, badges, packaging, and interface text. Check whether the wording remains consistent across frames and whether it matches the product or business context. A label that changes spelling while the object stays still deserves investigation. Correct spelling, however, does not establish that the image came from a camera.

Repeated details also need context. A catalog photograph can legitimately contain identical products; a tiled floor contains repetition by design. The useful question is whether a distinctive mark, label, or irregular object appears duplicated where independent objects were claimed. Record the locations and compare the original pixels before drawing a conclusion.

Check File History and Content Credentials

Where available, compare the recorded creation information and editing history with the explanation supplied by the sender. Content Credentials can carry signed information about a file's origin and changes. The C2PA explanation of Content Credentials describes this provenance approach. Check what the reviewing tool actually validates, rather than assuming every displayed credential has undergone a complete verification.

Keep your conclusion specific: “The supplied file records an editing step” is different from “The event never happened.” If the source remains uncertain, ask for corroborating material instead of treating missing metadata as proof of AI generation.

How to Investigate a Suspected Deepfake Video

A video investigation needs both sequence and context. Review the original recording where possible, not only the short segment that attracted attention. Establish what the clip is supposed to show and whether it is being presented as a recording or a live interaction.

1. Watch the clip at normal speed. Note the exact moments that require closer examination, including changes of speaker, camera cuts, or an instruction that affects a business decision.
2. Compare nearby frames. Look before and after the suspicious moment. Does the detail persist, or appear only in one frame? Record the timestamp so another reviewer can examine the same sequence.
3. Review sound and picture together. An apparent mismatch deserves investigation, but it does not establish its cause. Compare the supplied file with another version if one is available.
4. Keep frame assessments separate from video conclusions. An image detector examining a captured frame has not assessed every frame, the soundtrack, or the original recording process.

A live meeting presents another constraint: you may only see the current participant view, not an original media file. That is where the meeting-specific workflow below differs from reviewing a recording. Do not describe a visible-video check as an examination of everything transmitted during the call.

Track What Changes From Frame to Frame

Choose a short sequence around the concern and follow one feature through it. This is more reproducible than jumping between unrelated screenshots. Useful observations include:

• Occlusion: when a hand, microphone, or cup crosses the face, check whether boundaries disappear and return consistently. Note the frames before, during, and after the overlap.
• Feature continuity: follow a glasses frame, earring, badge, or product label. Record any abrupt change in shape or position that is not explained by movement or a cut.
• Mouth and audio timing: compare visible speech with the audio across more than one phrase. A delay throughout the recording may have a different explanation from an isolated discontinuity.
• Scene continuity: check whether objects remain present between camera movements. Separate a real edit or scene transition from a change within an otherwise continuous shot.

Keep playback settings in your notes. Slow motion can help locate a frame, but it also changes how speech and movement feel. Return to normal speed before describing the behavior. Do not treat low frame rate, a frozen connection, background removal, or a beauty filter as proof that the speaker's identity has been replaced.

What About AI-Generated Audio and Text?

Suspicious Voice Messages and Calls

Separate two questions: whether a recording may have been synthesized or edited, and whether you should act on its message. Even if the voice sounds familiar, a request to change payment details or disclose account information should follow your existing verification process. Call back using a previously established contact, not a new number supplied in the suspicious message.

For a recorded file, document the source and the passage that concerns you. Waveforms and spectrograms can help a reviewer navigate audio, but a visual pattern alone is not a reliable basis for declaring a voice cloned. Do not apply the result of an image or video-frame assessment to the audio track.

Listen for Changes, Not a Supposed “AI Voice”

Listen once for meaning, then replay the specific passage that needs checking. Note abrupt changes in room sound, volume, reverberation, or the transition between words. If a sentence appears assembled from separate pieces, record where the transition occurs and compare it with the surrounding audio. Noise suppression, microphone changes, editing, and connection problems are alternative explanations to consider.

An even rhythm, unusual pronunciation, few pauses, or a flat tone is not enough to identify synthetic speech. People speak differently, and assistive speech tools have legitimate uses. Verify a sensitive request through an established channel rather than trying to establish identity from how natural the voice sounds.

Articles, Messages, and AI-Written Text

For text, start with the claims rather than the writing style. Follow cited sources, check quotations against their originals, and confirm whether named people, organizations, and events match the context. These checks remain useful whether a person or an AI system drafted the message.

Polished wording, repeated phrases, or grammatical mistakes are not enough to settle authorship. If authorship matters, request information about the drafting and review process. If factual accuracy matters, verify the statements themselves. Neither FACEIO facial authentication nor Meeting Shield is an AI-writing detector.

Trace the Original Image or Video

A source check may resolve the problem without deciding whether AI was involved. A genuine product photograph copied from an older listing does not prove that the sender currently owns the item. A real recording reused with a new caption can misrepresent an event without changing a single frame.

1. Keep the submission context. Record the page or message where you received the media, the accompanying claim, and the time you obtained it. A downloaded file by itself may lose the explanation you need to assess.
2. Search for previous uses when appropriate. Use a reverse-image search service for public material, or search a distinctive visible phrase. For a video, a clearly identified frame may help locate other copies. Check permission before uploading confidential media to an external search provider.
3. Open the matching pages. Compare captions, publication dates, image crops, and stated authorship. Search results are leads, not proof that the first result is the original creator.
4. Ask the source a specific question. Request the original file, an explanation of an edit, or supporting material connected to the claim. “Can you provide another view of this item with the same label?” is more actionable than “Prove this is not AI.”

Do not interpret an unsuccessful search as confirmation of authenticity. Private, newly created, cropped, or unindexed material may have no searchable match. Likewise, a matching image may come from a repost rather than the origin. Keep the source trail and the content assessment as separate findings.

This is a general research workflow, not a claim that FACEIO or PixLab Forensic performs reverse-image search. For additional reading on combining investigation methods, see the GIJN guide to detecting AI-generated content.

Metadata, Compression, Watermarks, and File Analysis

File analysis can help distinguish an observed inconsistency from a conclusion about its cause. Preserve the supplied file and work on a copy. Label exports, screenshots, crops, and captured frames as derived material so another reviewer knows exactly which version was examined.

Metadata Records Claims About a File

A timestamp or software tag can guide a question to the sender, but it is not an independent witness. Ask whether you are looking at camera metadata, an editor's export information, or the properties of a newly saved copy. A screenshot's file details describe that screenshot; they do not necessarily describe the photograph displayed inside it.

Compression and Noise Maps Need Interpretation

Error Level Analysis, or ELA, highlights differences produced by recompressing a JPEG. It is an inspection aid, not an AI detector by itself. Bright regions can reflect ordinary edges, texture, or previous processing rather than a pasted object. Noise maps similarly help locate variation; a smooth patch alone does not establish how the image was made.

Write a narrow finding such as “The area around the label responds differently in this diagnostic view.” Then compare the source image and ask what processing it underwent. Do not convert the brightness of an analysis overlay into a percentage chance of fraud. The Forensically documentation explains these image-inspection methods and cautions against interpreting their output as standalone proof.

File Hashes Track Files, Not Truth

A cryptographic file hash, such as SHA-256, is useful for recording the exact bytes reviewed and checking whether a copy has changed. It does not reveal whether the content depicts a real event. Two different files can show the same scene with different compression, while one unchanged file can be shared with conflicting captions. These file checksums are not Facial IDs or biometrics hashes used by recognition engines.

Visible Labels, Watermarks, and Signed Provenance

Keep these forms of information distinct. A visible “AI-generated” label is a disclosure. A digital watermark requires a detector that supports the relevant marking scheme. Signed provenance such as Content Credentials records claims about the asset and its history. None should be confused with a generic visual assessment of the scene.

Record which check ran and what it confirmed. “No supported watermark found” is not the same as “not AI-generated.” A signature result also needs its stated scope: checking a claim signature is different from validating the asset binding and trust in the signer. Do not describe a limited check as a complete authenticity certificate.

How to Interpret an AI Detector Result

Before acting on a result, read the tool's definition of its output. A label, confidence value, or risk score may describe different things. Do not assume a score is the probability that a person is lying, that a transaction is fraudulent, or that every part of a recording is synthetic.

• Check the assessed input. Was it the original image, a preview, a screenshot, or a captured video frame? Keep that information with the result.
• Read the explanation. Identify which observation needs corroboration. An unsupported conclusion is less useful than a result that directs the reviewer to a specific question.
• Distinguish uncertainty from success. An unavailable service, a failed analysis, or an inconclusive result means the question remains open. It does not mean “not AI.”
• Avoid inventing a combined score. Do not average unrelated tool outputs or frame results into an overall authenticity percentage unless the system documents and validates that method.

For deployment, test the complete review process with material you are authorized to use: known originals, declared synthetic examples, and files resembling normal submissions. Check how staff handle ambiguous results as well as clear alerts. Your acceptance criteria should include an appropriate response and a route for legitimate users, not just whether a detector displays a warning.

Questions to Ask Before Relying on a Detection Tool

• What does it detect? Distinguish general image generation, face manipulation, replay attacks, and audio synthesis. Support for one task does not imply support for all the others.
• What input conditions were evaluated? Ask about examples similar to yours, including ordinary camera footage, compressed uploads, edited media, and generated content. A benchmark figure alone does not describe your workflow.
• What happens when analysis cannot complete? An explicit error or unsupported-input state is different from a negative detection. Your interface and backend should preserve that distinction.
• Where does the material go? Establish whether analysis is local or uses a connected service, what is transmitted, and which handling terms apply. Do not upload customer files before checking authorization.
• Who handles disputes? Define who reviews an alert, what evidence they need, and how a legitimate user can resolve a failed check.

Choose the Tool for the Situation

A face login attempt, a live business meeting, and an uploaded video are different problems. Use a tool designed for the material and the decision in front of you.

• Facial authentication on your website or web app: configure FACEIO liveness and face spoof protection alongside PIN Code validation and your backend access controls.
• Live browser meetings: use Meeting Shield to review suspicious deepfake, replay, and synthetic-video signals in visible participant video.
• Image and video investigation: use PixLab Forensic to examine media and request connected assessment of an image or selected frame.

Deepfake and Spoofing Protection for Facial Authentication

During facial authentication, the question is not simply whether an image contains AI-generated content. The system also needs to assess a face capture for signs of an attempted spoof. A printed photo or a replayed video can be used in an attack even when the original media is genuine.

FACEIO provides built-in liveness and anti-spoofing controls for its facial authentication flow. Review and enable face spoof protection for your application. When the flow flags a suspected presentation attack, it can return fioErrCode.PAD_ATTACK. Your website or web app should handle that result through controlled retries, an alternative access method, or review, not silently continue the login.

Pair those checks with PIN Code validation. Requiring the user to confirm their PIN adds a separate check after face verification. It does not classify a video as real or fake, but it means a convincing face capture alone is not enough to complete that configured authentication flow.

To implement facial authentication, create an application in the FACEIO Console, obtain its Public ID, and follow the Getting Started guide. The fio.js integration guide covers enroll() for new users and authenticate() for returning users. Your backend remains responsible for granting access.

For a closer look at photo, replay, and synthetic-input attacks, read the face anti-spoofing and liveness detection guide. Broader implementation references are available in the Developer Center.

Spotting Deepfake Risk in Online Meetings

A remote interview, vendor call, or executive meeting does not follow the same workflow as a website login. The team needs information during the conversation, especially before sharing confidential material or acting on an unusual request.

FACEIO Meeting Shield is a Chrome extension for Google Meet, Zoom Web, Microsoft Teams Web, and Cisco Webex browser meetings. It analyzes visible meeting video for suspicious deepfake, synthetic, manipulated, or replayed-video signals and reports risk information for the user to review.

Meeting Shield analyzes browser meetings, not video inside native desktop meeting apps. A risk signal is a reason to check further, not an accusation or proof of impersonation. Equally, a meeting without an alert should not replace normal approval procedures. If a caller requests an urgent transfer or a change to account access, confirm the request through a known contact channel.

A Response Procedure for Meeting Hosts

Decide before a call which requests require separate approval. During a concern, pause the sensitive action, note what prompted the review, and use the organization's established contact route. Do not ask the participant to reveal a password, one-time code, or FACEIO PIN to prove who they are. Authentication secrets belong in the intended authentication flow, not in a meeting chat.

If you offer another call or verification method, make it a consistent process rather than an improvised “deepfake challenge.” Asking someone to blink, turn, or wave is not a substitute for your account controls or approval policy. Keep meeting risk assessment separate from the authority to grant access, disclose information, or approve a transaction.

Teams can review the product and request access through the Meeting Shield page and the FACEIO Console.

Investigate Images and Video With PixLab Forensic

PixLab Forensic is an online workbench for investigating images and videos for deepfakes and AI-generated content. Review local evidence, inspect available metadata, and capture video frames for closer examination.

You can request connected AI assessment of an image or selected frame when an analysis service is configured. That assessment concerns the selected image or frame; it is not a verdict on an entire recording. Opening a file for local examination does not automatically request connected AI analysis.

Audio and text tools support manual investigation through features such as waveform and spectrogram inspection or reference analysis. These tools do not provide automated AI-writing, voice-cloning, or live-stream deepfake verdicts.

Open PixLab Forensic to examine a source, compare observations, and record findings. Before requesting connected assessment, review what will be sent to the configured service and whether you have permission to share it.

A Practical Image and Video Investigation

Consider a hypothetical supplier sending a short video as evidence that a product is ready for dispatch. One frame looks unusual. The business question is whether the submission supports the shipment claim, not merely whether a detector can label the frame.

1. Write down the claim. Record what the supplier says the video proves, where the file came from, and which order it concerns. Keep your working notes separate from the original submission.
2. Inspect the relevant sequence. Review the moments around the unusual frame and note the timestamp. Compare visible product details with the order information you already hold.
3. Examine a selected frame. Use the PixLab Forensic workflow described above if a closer image review is appropriate. Label the capture as a frame from the video, not an independently supplied photograph.
4. Record the limits of any assessment. Note which image was submitted for analysis and what the result actually says. Do not turn a frame-level observation into a claim about every item in the shipment.
5. Resolve the business question. Ask the established supplier contact for clarification or supporting records. Follow your receiving and approval procedures before releasing funds.

A useful investigation note might read: “The frame at 00:18 needs clarification; the remaining footage and shipment claim have not been verified.” That gives the next reviewer a concrete task. “The AI tool says fake” does not explain the evidence, the scope of the check, or what action is justified.

Examples for Hiring, Payments, and Customer Support

The following examples illustrate response planning, not documented customer incidents or claims that a product prevents every attack.

Remote Interviews

An interviewer notices unusual video behavior or receives a Meeting Shield risk signal. The practical response is to note the concern, check whether connection quality is affecting the call, and follow a consistent process for another meeting or separate confirmation. A warning should not automatically become a rejection. Keep hiring decisions separate from a tool's assessment of visible video.

Payment and Account-Change Requests

A caller who appears to be a manager requests a new bank destination. Whether or not the call produces a deepfake alert, the team should use its established approval process and independently confirm the change. Meeting analysis provides an additional signal; it does not authorize a transfer or validate bank details.

Website Login and Account Recovery

A returning user attempts facial authentication, but the configured anti-spoofing check flags the session. Handle the error and offer the access or support path your policy allows. Do not bypass the failed check just because a support agent receives a convincing video message. FACEIO supplies authentication results; your website or web app decides account access and recovery approval.

For implementation, connect these response paths to the documented fio.js error codes and review the security configuration. Assign responsibility for investigating repeated failures so that an alert leads to a defined action rather than an unattended log entry.

What to Do When a Check Raises Concerns

Make the response proportional to the decision. A questionable illustration may need a source check. A suspicious login should follow your account-security policy. An unusual request during a business call may need a pause and independent confirmation.

Keep observations separate from conclusions. Record what was assessed, what the result said, and what remains uncertain. Avoid labeling a person or file as fraudulent solely because of one detector result. False positives and missed detections are possible, and legitimate users need a way to resolve a failed check.

For website owners, define retries, PIN requirements, alternative access, and support procedures before rollout. Use the FACEIO security guidance and application privacy guidance to plan the authentication flow without collecting unnecessary user data.