How to Spot a Deepfake: A Practical Guide to AI Video Verification

How to Spot a Deepfake

A practical deepfake investigation begins by preserving the available evidence and establishing the video’s source. Save the URL, available file, publication date, uploader information, and the claim being made about the footage. This information can become important later because online posts may be edited, deleted, replaced, or reposted without their original context.

Next, investigate the video’s provenance and history. Determine whether an earlier or original version exists, whether the footage has appeared elsewhere, and whether the current copy has been edited or compressed by a platform. If the original file is available, examine its metadata and any available provenance information.

The investigation should then move from source verification to media analysis. Extract representative frames when appropriate, search for earlier versions, examine visual and audio consistency, and investigate unusual changes across frames. After that, verify the location and timing of the claimed event and compare the footage with independent evidence.

The basic process is:

Source → Provenance → Search → Media Analysis → Context Verification → Corroboration → Documentation

The important principle is that no single visual clue, metadata field, or automated detector score should determine the conclusion by itself.

What Is a Deepfake?

A deepfake is synthetic or manipulated media created using AI or related computational techniques to alter a person’s appearance, voice, actions, or other aspects of audiovisual content. Common examples include face replacement, facial reenactment, synthetic voices, lip-sync manipulation, identity replacement, altered backgrounds, and combinations of genuine and synthetic material.

However, not every misleading video is a deepfake. A completely genuine video can be presented with a false date, incorrect location, misleading caption, wrong identity, or unrelated audio. In other cases, authentic footage may be selectively edited so viewers get a different impression of the original event.

This creates an important distinction between media authenticity and contextual accuracy. A researcher needs to establish not only whether the media itself has been manipulated, but also whether the claim being made about that media is accurate.

A genuine video can therefore be misleading, while a manipulated video can sometimes depict an event that genuinely occurred. The investigation needs to determine what the available evidence actually establishes rather than reducing every case to a simple “real or fake” decision.

Why Visual Inspection Alone Is Not Enough

Visual inspection remains useful, particularly as an initial screening method. Researchers may notice unusual facial boundaries, inconsistent lighting, strange reflections, unexpected changes between frames, or audio and lip-sync issues. These observations can help identify material that deserves closer examination.

They should not, however, be treated as definitive proof. Compression, resizing, poor recording conditions, platform processing, ordinary editing, lighting, and other technical factors can create artifacts that resemble signs of synthetic media.

Current NIST work on deepfake forensics also highlights the difficulty of maintaining detection performance when systems encounter unfamiliar content and real-world conditions. This is one reason a professional investigation should combine technical analysis with source history, contextual research, and independent corroboration rather than relying on a single detection method.
NIST Deepfake Forensics Evaluation

A useful rule is simple: a video that looks real has not necessarily been verified, and an unusual visual artifact does not automatically prove manipulation.

Start With the Source and Provenance

Before examining individual frames, establish where the video came from. Identify who uploaded it, when it first appeared, whether the account or organization is authentic, and whether the uploader has a credible connection to the claimed event. Then look for evidence that the video existed elsewhere before the current post.

Source history can sometimes resolve a misleading video without any sophisticated technical analysis. A video presented as current footage may be several years old. Footage from one location may be presented as coming from another. A genuine interview may be reposted with a caption that changes its meaning.

Content Credentials and Provenance

When available, Content Credentials based on the C2PA standard can provide verifiable information about the provenance and editing history of supported digital content. This can help researchers understand how an asset was created or modified and whether provenance information has been preserved through its lifecycle.
C2PA Specifications

Provenance should still be interpreted carefully. A provenance record can provide evidence about an asset’s history, but it does not independently establish that the event shown in the video actually happened or that the accompanying claim is true.

In other words, provenance is evidence about the media, not automatic proof of the event depicted in the media.

Check the Original File and Metadata

If the original file is available, examine its technical information. Depending on the file and how it was created or processed, metadata may include creation time, modification history, device information, software, file format, codec, resolution, or geographic information, if retained.

Metadata can sometimes reveal inconsistencies. For example, editing information could conflict with a claim that a file came directly from a recording device. A modification date might also raise questions about the stated timeline.

But metadata has important limitations. It can be removed, altered, lost during platform processing, or recorded inaccurately. A missing field is therefore not evidence that a video is fake, and an unusual field is not automatically evidence of manipulation.

The more useful question is whether the available technical information is consistent with the rest of the evidence.

Search for Earlier Versions of the Video

One of the most effective questions in video verification is: Has this footage appeared online before?

This matters because many misleading videos are not synthetic at all. They are genuine recordings that have been recycled with a different date, location, event, or caption. Finding an earlier version can therefore provide stronger evidence than trying to identify subtle AI artifacts.

Look for older uploads, longer versions, different captions, earlier publication dates, original reports, eyewitness posts, or versions of the footage that contain additional context.

Use Keyframes for Reverse Search

Because search engines generally do not treat an entire video like a conventional image, researchers can extract representative frames and search those images individually. Keyframes can reveal earlier versions of the same scene, related photographs, original reports, or posts that provide a different context.

The InVID Verification Plugin, for example, supports video fragmentation into keyframes and reverse-image searching of those frames through multiple image-search services. It also provides tools for examining video and image context and available metadata.
InVID Verification Plugin

A keyframe search may reveal that supposedly new footage existed years earlier, that a scene was originally associated with another event, or that the current post has removed important surrounding context.

Examine the Video for Visual and Audio Inconsistencies

After investigating source history, examine the media itself. The objective is not to find one magical “deepfake tell,” but to identify inconsistencies that require an explanation.

Faces and boundaries. Examine areas such as faces, hair, ears, glasses, teeth, hands, fingers, clothing, and objects that cross the face. Watch the same features across several frames rather than relying on a single screenshot. Unexpected changes in shape, texture, or boundaries may warrant further investigation.

Lighting and reflections. Compare the subject with the surrounding environment. Look at the direction and intensity of light, shadows, reflections in windows or mirrors, and other surfaces that provide additional representations of the scene. An inconsistency can be useful evidence, but it may also have an ordinary technical explanation.

Temporal consistency. Watch the footage continuously. Look for objects that change unexpectedly, facial boundaries that shift, lighting that behaves inconsistently, or transitions that don’t match the scene’s movement. A suspicious frame becomes more informative when the same anomaly appears repeatedly or coincides with other evidence.

This stage aims to identify patterns that can be tested against other evidence, not to declare a video fake based on one visual irregularity.

Check the Audio and Lip-Sync

Video verification should include the audio track because synthetic manipulation can affect voices as well as images. Check whether speech appears synchronized with visible mouth movements, whether room acoustics remain consistent, and whether background noise changes unexpectedly.

Researchers can also listen for unusual voice transitions, abrupt changes in sound quality, or edits that occur immediately before or after an important statement. These may be relevant clues, particularly when combined with visual or source-history evidence.

At the same time, audio anomalies can result from ordinary editing, dubbing, compression, poor synchronization, or recording conditions. A mismatch therefore suggests further investigation may be needed; it does not automatically establish that AI generated the voice or video.

Verify the Location and Date

A video’s physical environment can provide some of the strongest contextual evidence. Examine buildings, roads, signs, storefronts, utility poles, vegetation, mountains, coastlines, architectural features, vehicle markings, and other identifiable details. Compare those features with reliable geographic sources and available imagery.

The central question is whether the video could realistically have been recorded at the claimed location.

Time requires the same level of attention. A video can show the correct location but still have the wrong date. Weather conditions, daylight, shadows, seasonal vegetation, construction activity, advertisements, vehicle models, event schedules, historical imagery, and earlier uploads can help determine whether the footage matches the claimed period.

A mismatch does not automatically mean the video is synthetic. It may instead indicate that genuine footage has been misdated or placed in the wrong context.

Look for Independent Corroboration

Don’t evaluate a suspicious video in isolation. Depending on the event, useful evidence may include official statements, original photographs, independent videos, eyewitness material, local reporting, public records, archived webpages, contemporaneous news coverage, satellite imagery, or other relevant records.

The goal is not simply to collect a large number of links. It is to find independent evidence that either supports or contradicts the claim.

For example, an earlier upload may establish the original date, geographic evidence may confirm the location, and independent reporting may confirm that the event occurred. Together, these sources provide a stronger evidentiary basis than a single automated tool.

This is the principle of converging evidence. When different evidence streams independently point toward the same explanation, confidence in the conclusion increases.

Deepfake Detection Tools: Supporting Evidence, Not a Final Verdict

Automated deepfake detectors can help screen large amounts of media and flag material that deserves human attention. Depending on the system, they may analyze visual characteristics, audio, facial regions, or other technical features associated with manipulated content.

Their limitations are equally important. Performance can vary by generation method, type of manipulation, video quality, compression, resolution, editing, and whether the detector encountered similar content during development or evaluation.

NIST’s ongoing work in synthetic-content detection illustrates why detector results need to be interpreted in context. Detection systems can perform differently when moved from controlled testing environments to operational settings or when they encounter previously unseen generation methods. NIST AI Challenges: Forensics

For this reason, a result such as “87% likely to be AI-generated” should not automatically be translated into “the video is fake.” The researcher should understand what the detector measures, how it was evaluated, whether it applies to the type of media being examined, and whether its result is consistent with the source history and other evidence.

A detector can contribute evidence to an investigation. It should not replace the investigation.

The Most Important Distinction: Authentic Video vs. False Context

One of the biggest mistakes in online video verification is treating every case as a simple question of whether the media is real or fake.

Consider four possibilities:

Media	Context	What it means
Authentic	Accurate	Genuine footage correctly presented
Authentic	False	Genuine footage presented with misleading context
Manipulated	Accurate	An actual event represented using altered media
Manipulated	False	Both the media and surrounding claim are misleading

This distinction is especially important when investigating viral content. A genuine video may circulate with a false caption, incorrect date, or wrong location, while a manipulated video may incorporate real footage from an actual event.

The researcher therefore needs to establish two separate things:

• What happened to the media?
• What does the media actually prove?

That is often more useful than simply assigning a real-or-fake label.

How to Assess the Total Evidence

The final assessment should consider the evidence as a whole.

For example, suppose a video has an unclear provenance record, an earlier version appears under a different caption, its location matches the claimed event, and an automated detector flags possible manipulation. None of those findings should automatically determine the conclusion. Instead, the researcher should investigate how they relate and whether independent evidence can explain the discrepancy.

A useful evidence record might look like this:

Evidence	Finding
Source history	Earlier version located
Keyframe search	Previous upload found with different context
Provenance	Available information examined
Metadata	Useful but incomplete file information
Location	Visible environment matches the claimed location
Audio	No obvious synchronization anomaly
Detector	Possible manipulation signal
Independent sources	Evidence supports or challenges the claim

The value comes from the relationship between the findings, not from any individual row.

A strong conclusion should explain what the evidence establishes, what it does not establish, and where uncertainty remains.

How to Document a Deepfake Investigation

Professional verification should leave an audit trail. Record the original URL, uploader, date accessed, claim being investigated, available file information, provenance information, keyframes used for searching, relevant metadata, geographic and temporal checks, audio observations, detector results, independent sources, and the final assessment.

Also record uncertainty. If the available evidence cannot establish whether a particular alteration occurred, say so. A defensible research conclusion is not weakened by acknowledging a genuine evidence gap.

A useful verification record can include:

Field	What to record
Original source	URL and uploader
Claim	What the video is alleged to show
Date	Publication and access dates
File information	Filename and available technical details
Provenance	Content Credentials or other available history
Keyframes	Frames selected for reverse search
Context	Location, date, and event verification
Technical findings	Visual, audio, or metadata observations
Detection tools	Tool used and result
Independent evidence	Supporting or conflicting sources
Assessment	What the evidence establishes
Uncertainty	What remains unresolved

This documentation makes the investigation more reproducible and allows another researcher to understand how the conclusion was reached.

A Practical Deepfake Verification Workflow

For routine research, the entire methodology can be summarized as preserve, identify, trace, inspect, locate, date, corroborate, and document.

Preserve the available media and its surrounding context before the content changes. Identify who published it and what is being claimed. Trace the footage to earlier versions and possible original sources. Inspect the media for relevant visual, audio, provenance, and technical evidence.

Then verify the location and date against independent evidence. Corroborate the event using appropriate sources rather than relying on the video itself. Finally, document what was checked, what was established, and what remains uncertain.

This workflow is more defensible than simply watching a video and deciding whether it “looks AI-generated.”

Common Mistakes When Checking for Deepfakes

A common mistake is looking only at a person’s face. Manipulation can involve voices, objects, backgrounds, identity, editing, or context, so facial inspection alone cannot establish authenticity.

Another mistake is assuming that poor video quality indicates AI generation. Compression, repeated uploads, low-resolution recording, and platform processing can all create artifacts unrelated to generative AI. Conversely, high-quality footage does not prove authenticity.

Researchers should also avoid treating one visual anomaly or detector score as a verdict. Individual signals can have multiple explanations, and automated systems have different strengths and limitations.

Finally, do not overlook source history. A genuine video with a false caption can be more misleading than a technically obvious synthetic clip. In many investigations, finding the original upload and establishing its context provides more useful evidence than trying to identify every possible AI artifact.

Deepfake Verification Checklist

Before describing a video as authentic, manipulated, or misleading, confirm that you have considered its source, provenance, publication history, and available original file. Search representative frames for earlier versions and investigate whether the footage has appeared in a different context.

Check whether the claimed location and date match the visible environment. Examine relevant visual and audio characteristics, but distinguish genuine anomalies from artifacts caused by compression or ordinary editing. If you use an automated detector, record the tool and result without treating the score as conclusive.

Most importantly, compare the video with independent evidence and consider whether the media itself is authentic but the surrounding claim is false. If significant questions remain unresolved, state that uncertainty rather than presenting a stronger conclusion than the evidence supports.

Frequently Asked Questions

How can I tell if a video is a deepfake?

Start with the video’s source and provenance, then search for earlier versions and examine relevant frames, audio, and technical information. Verify the claimed location and date and compare the footage with independent evidence. Automated detectors can provide additional evidence, but they should not be the sole basis for a conclusion.

What are common signs of a deepfake?

Potential clues include inconsistent facial or object boundaries, unusual lighting or reflections, unexpected frame-to-frame changes, and audio-video synchronization problems. These clues should trigger further investigation rather than being treated as definitive proof.

Can you detect a deepfake by looking at someone’s eyes?

Eye behavior can sometimes provide a useful clue, but it should not be treated as a standalone deepfake test. Modern synthetic media, video quality, lighting, and normal human variation can make individual visual signals difficult to interpret reliably.

Is metadata enough to prove that a video is fake?

No. Metadata can provide useful information about a file’s history, but it can be incomplete, modified, or removed during processing. Consider it alongside provenance, source history, technical analysis, and independent evidence.

Can reverse video search detect deepfakes?

Reverse video or keyframe searching is particularly useful for finding earlier versions of footage and identifying videos that have been reused or placed in a false context. It does not by itself prove that newly generated footage is synthetic.

Are AI deepfake detectors accurate?

Detector performance varies by system, media type, generation method, compression, and testing conditions. Current NIST work highlights the challenges involved in maintaining detection performance under operational conditions and with unfamiliar content.
NIST AI Challenges: Forensics

What are Content Credentials?

Content Credentials are based on the C2PA standard and can provide verifiable information about the provenance and editing history of supported digital content. They can help establish information about an asset’s history, but they do not independently prove that the event shown in the content actually happened. C2PA Specifications

Can a real video still be misinformation?

Yes. Genuine footage can be presented with a false date, location, identity, caption, or interpretation. Video verification therefore needs to assess both the media and the claim attached to it.

Conclusion

Spotting a deepfake is not simply a matter of finding one strange-looking frame or running a video through a detection tool.

A stronger investigation follows the evidence from its source through its history, technical characteristics, context, and independent corroboration. The researcher should preserve the original material where possible, establish provenance, search for earlier versions, examine relevant visual and audio characteristics, verify the claimed location and date, and document the evidence used to reach the conclusion.

The most important question is therefore not simply:

“Is this video real or fake?”

It is:

“Where did this video come from, what happened to it, what does it actually show, and what independent evidence supports the claim being made about it?”

That approach is more useful for professional research because it accounts for both synthetic media and genuine footage placed in a false context.

Do not rely on what a video looks like alone. Verify what the evidence shows.