How to Verify a Photo Before You Share It: A Practical Guide

Step 1: Reverse image search, before anything else

The highest-value twenty seconds you will spend is putting the picture itself into a reverse image search rather than reading the caption one more time. Three services are worth knowing, and they are good at different things.

• Google Lens has the largest index and tries to recognize what is in the frame, not only find byte-identical copies. It is the best first stop for finding the same scene republished at a different size or crop.
• TinEye is narrower on purpose: exact and near-exact duplicates across roughly 79 billion indexed images. It has one feature the others lack, which is the ability to sort matches by oldest.⁴
• Yandex remains unusually strong at near-duplicate and face-similar matching. Bellingcat's investigators have rated it above Google and Bing for this specific job for years.³

Run at least two of them. The indexes barely overlap, and a photo that returns nothing in one is often the top result in another. Then crop and search again. Mirroring, recoloring and cropping all defeat exact matching, which is exactly why people who recycle images do those things.³ A tight crop on a street sign, a jersey number or a single face often finds what the full frame cannot.

Reading the results is where people go wrong. You are not looking for a verdict, you are looking for one of three situations. Copies that predate the event in the caption mean the image is recycled, and you can stop there. Copies that exist only on aggregator and engagement accounts mean the picture has no traceable origin, which is itself a finding. Zero results mean very little: a genuinely new photo has no matches, and so does a freshly generated one.

Step 2: Find the earliest copy, then the original context

Sort TinEye by oldest. In Google, open Tools and set a custom date range that ends before the claimed event. What you want is the earliest publication, because the earliest publication usually still carries a real caption with a place, a date and a photographer.

This step matters more than the generation question, because the most common kind of visual misinformation is not a fake image. It is a real one. Researchers call it false context; fact-checkers call it miscaptioned. A 2024 dataset of 1,676 fact-checked images, organized around the questions of where, when and what actually happened, found out-of-context reuse to be one of the categories fact-checkers encounter most often.⁵ The question to answer is not only whether a photo was generated. It is whether the photo shows the thing the caption says it shows.

Step 3: Check the account, not just the pixels

This is the cheapest signal available and the one most people skip. Open the profile and look at four things: when it was created, how often it posts, whether its older posts are in a different language or about an unrelated subject, and whether the same caption text appears word for word on other accounts. An account created three weeks ago that posts eleven breaking-news photographs a day from four countries has told you what it is. You do not need to examine the image at all.

Then ask where else the picture should be. A photograph of a large public event will normally reach a wire service, a local outlet or an official account within hours. An image of something supposedly enormous that exists on one anonymous account and nowhere else is making a claim about itself.

Step 4: Read the metadata, and expect it to be missing

EXIF data records camera make and model, lens, exposure, a timestamp and sometimes GPS coordinates. Any free browser-based EXIF viewer will show it. When it survives it is strong evidence. It usually does not survive. The IPTC has been testing metadata retention on major platforms for over a decade, and the picture has not improved: in its widely cited round, only Behance preserved everything, while most sites removed more than they had three years earlier.⁶ Instagram, Facebook, X, TikTok, LinkedIn and Discord all re-encode images on upload, and re-encoding discards EXIF, IPTC and C2PA data alike. A screenshot, by definition, carries none of it.

C2PA Content Credentials are the durable alternative: a cryptographically signed record of how a file was captured and edited. Drop the file on contentcredentials.org/verify, the open-source verification app released in January 2026, and it reads the manifest in your browser without the file leaving your machine.⁷ Credentials are now signed at the moment of capture by the Leica M11-P (October 2023), Sony's a1 and a7S III (firmware, March 2024), the Canon EOS R1 and R5 Mark II (July 2025), and by the Google Pixel 10 camera app by default since September 2025. LinkedIn, TikTok and YouTube display the resulting labels on upload.⁷

Two warnings about credentials. The absence of one proves nothing, since almost no image on the internet has one. And the presence of one proves origin, not honesty. A valid signature on a misleading photograph is still a valid signature, and a 2025 firmware flaw in the Nikon Z6III let fabricated content carry valid signatures until the affected certificates were revoked.⁷ We covered the standard and its gaps in more detail in what C2PA actually is.

Since May 2026 there is also a free check built into tools most people already have. Google Lens, Circle to Search, Chrome and the Gemini app flag AI generation using SynthID watermarks and read C2PA credentials where they exist, though Google says plainly that this is less reliable on content from other AI platforms.⁸ Treat a hit as informative and a miss as nothing. The same asymmetry applies to platform labels: Article 50 of the EU AI Act makes deepfake disclosure enforceable from August 2, 2026, so labels will become common in European feeds, but an unlabeled image is not thereby verified.¹⁴

Step 5: What your eyes still catch, and what they no longer do

Retire the 2023 checklist. Six-fingered hands, garbled text on signage, earlobes that melt into jawlines: current models have largely fixed those, and anyone still relying on them is working from a three-year-old threat model. Microsoft's AI for Good Lab ran roughly 287,000 image judgments past more than 12,500 participants and recorded 62 percent accuracy overall, with people doing best on human portraits and worst on natural and urban landscapes.²

What is still worth thirty seconds is physical consistency rather than anatomy. Do all the shadows fall in one direction, and are they the right length for the light source? Does the reflection in a window, a pair of glasses or standing water match what should be in front of it? Does a repeated texture, such as faces in a crowd, brickwork, foliage or chain-link fencing, repeat identically rather than irregularly? Do small background objects resolve into recognizable things when you zoom in, or dissolve? These are prompts to go and check something external, not conclusions. Our longer breakdown of which visual cues survived and which did not is in how to tell if a photo is AI-generated.

Step 6: Let someone else do the work

Search the claim in words, not the image. If a picture is circulating widely enough to matter, somebody has probably already checked it. The International Fact-Checking Network's signatories, AFP Fact Check and Snopes cover most English-language viral claims. In Japan, the Japan Fact-check Center, set up by the Safer Internet Association on October 1, 2022, publishes around forty checks a month and runs free public courses on image verification.¹³

Community Notes on X are useful and badly timed. A study in PNAS in September 2025 examined 40,078 posts where notes were proposed, of which 6,757 received a note rated helpful. In the 48 hours after a note appeared, repost growth fell 46.1 percent and likes 44.1 percent. Measured across a post's whole life, the reduction was 11.6 percent of reposts, because most of the spread had already happened before the note arrived.¹¹ Coverage is the bigger limit: an analysis of 1.76 million notes in 55 languages written between January 2021 and March 2025 found that of the roughly 1.12 million English-language notes, only about 82,800, roughly 7 percent, were ever displayed.¹² A visible note is a strong signal. The absence of one is close to no signal at all.

Step 7: Where automated detectors belong

We build one of these, so we will be blunt about the limits. In September 2026, researchers evaluated twelve published deepfake detectors, using the authors' own checkpoints, against a corpus of about one million real smartphone photographs. On modern AI content no detector exceeded an AUC of 0.624, and five of the twelve scored below chance. Thresholds calibrated on older GAN data made several of them look deployable, with false-alarm rates under 11 percent on real photographs; refit the same criterion on current content and those detectors flagged between 17 and 91 percent of genuine photos as fake.¹⁰

A NewsGuard audit in May 2026 found the same thing in the field. Fifteen authentic news photographs went through five commercial detectors: ScamAI declared six of them AI-generated, ZeroGPT three, AI or Not one, while Hive and Sightengine got all fifteen right.⁹ The consequence is not only that fakes slip through. It is that a bad actor can point at a detector score to dispute a real photograph.

Maat Scan sits at this step, and only at this step. It scores photographs of people from 0 to 100 for signs of AI generation and editing. It covers images containing human faces, and the number is a statistical reference rather than a verdict: a high score means the image resembles generated or heavily edited images in our calibration data, not that anything has been proven. Weigh it alongside the reverse search, the earliest copy and the account history, and if it is the only thing pointing one way, it is not enough. Why this problem keeps getting harder is the subject of our piece on the detection arms race.

The two-minute version

1. Reverse image search in two engines. Then crop to a distinctive detail and repeat.
2. Sort for the oldest match and read its original caption.
3. Open the account. Creation date, posting rhythm, language history.
4. Check metadata: an EXIF viewer, contentcredentials.org/verify, and the AI check in Lens or Chrome.
5. Zoom for physical consistency: shadows, reflections, repeated texture.
6. Search the claim in words for an existing fact-check or a visible note.
7. If doubt remains and the subject is a person, run a detector and weigh it with everything above.
8. Decide. If two independent signals disagree, do not share it.

What not to do

Do not rest on one signal. Every method here has a documented failure mode, and they fail in different directions: reverse search misses new images, metadata is usually stripped, human inspection runs at 54 to 62 percent, and detectors call real photographs fake at double-digit rates.¹²⁹¹⁰ Agreement between two methods that fail differently is worth far more than confidence from one.

Do not accuse anyone publicly. Resharing something with "this is AI" is itself a claim, and when it names a person it is an accusation about their honesty. Given the false-positive rates above, you will sometimes be wrong, which means spreading a different falsehood about someone's integrity. Report it to the platform and tell the person who sent it to you. That is where a correction belongs.

Do not assume a real photograph means a true caption. An image can pass every authenticity check in this guide and still be lying about where and when it was taken, which is the common case rather than the exotic one.⁵ And do not share a fake in order to debunk it. Quote-posting the image with a correction attached hands it precisely the reach it was built for. Describe the claim in words, link the fact-check, and leave the picture out.

The procedure above takes about two minutes. That is roughly sixteen times longer than the 7.3 seconds the experiment measured people actually spending. The gap is the whole difference between looking and checking.