Direct answer: Treat visible glitches as leads, not proof. Find the earliest and longest version, check whether reliable sources confirm the event, inspect motion and audio across time, review provenance when available, and avoid relying on a single deepfake detector. If the stakes are high, preserve the original and seek professional analysis.
Define what might have been manipulated
“Deepfake” is often used for several different problems: a fully generated person, a face swap, lip synchronization, cloned speech, edited timing, a real clip with a false caption, or an ordinary impersonator. These require different checks. Write the precise claim: did this person say these words, at this place and time, in an uninterrupted recording?
A short repost may be authentic video clipped to reverse its meaning. A fake audio track may be placed over real footage. A video-call scam may use a puppet-like face while the voice comes from another system. Do not let one convincing element validate the rest. Separate identity, speech, location, date, continuity, and caption into claims that can each be tested.
- Record the URL, account, caption, upload time, and claimed event.
- Ask what decision the video is trying to trigger immediately.
- Delay sharing, payment, voting claims, or accusations until verification catches up.
Find the original and the surrounding minutes
Search key phrases, quoted speech, event names, and distinctive frames. Trace reposts toward the earliest available upload and look for a full interview, livestream, press conference, body-camera file, or recording from another angle. A longer source can reveal a cut, parody label, audio substitution, or missing question that a viral excerpt concealed.
Compare publication chronology and source accountability. An official archive or named journalist is stronger than a chain of accounts citing one another. Still verify official-looking accounts and domains because impersonators copy branding. If the alleged event was public, seek contemporaneous transcripts, schedules, photographs, and reports from independent observers.
- Extract several clear frames and reverse-search them separately.
- Search a distinctive sentence in quotation marks.
- Prefer the highest-quality file closest to the recording source.
Inspect motion over time instead of pausing on one face
Video synthesis can struggle with occlusion, fast turns, hands crossing a face, glasses, hair, changing light, teeth, reflections, and identity consistency between frames. Watch once at normal speed for behavior and continuity, then at slower speed around transitions. Compare the face with ears, neck, hairline, jewelry, and the motion of the whole body.
Real video also contains rolling-shutter distortion, dropped frames, stabilization, low-light noise, beautification filters, autofocus, and video-conference background effects. Compression can make lips appear detached or erase fine detail. A single frozen anomaly is therefore weak. Look for a recurring pattern tied to facial motion or an edit boundary and ask whether the encoding history offers a simpler explanation.
- Check whether shadows and reflections update as the subject moves.
- Observe objects passing in front of the face and the recovery afterward.
- Compare frame rate and quality before and after a suspicious transition.
Listen to the audio as its own piece of evidence
Cloned or edited speech may have unnatural pacing, flattened emotion, inconsistent room acoustics, missing breaths, abrupt background-noise changes, odd pronunciation, or responses that do not fit the conversation. Yet phone codecs, noise suppression, disability, language background, and a poor microphone can produce the same features. Familiarity with a person’s voice is not authentication.
Check synchronization across consonants, jaw motion, throat movement, and gestures, but remember that high-quality lip sync can align these well. Use headphones to locate cuts and changes in ambience. If the clip requests money, credentials, secrecy, or urgent action, verify the person through a known number or another established channel. Do not call a number supplied inside the suspicious message.
- Compare with verified recordings from a similar date and setting.
- Notice whether crowd or room sound continues naturally through cuts.
- Use a private family or workplace verification question when impersonation is plausible.
Use provenance and detectors within their limits
C2PA Content Credentials may document capture and edits when the file retains a valid credential. Read the signer and action history rather than treating the presence of a badge as a truth guarantee. Social platforms and screen recordings can remove provenance, so missing credentials do not establish fakery. Conversely, authentic capture provenance does not validate a later misleading caption.
Deepfake detectors are evaluated against particular manipulation methods and datasets. New generators, recompression, cropping, or adversarial changes can reduce accuracy, and false positives can harm real people. Detector results should support an investigation, not end it. High-consequence evidence belongs with a trained forensic examiner who can preserve files, document methods, and explain limitations.
- Do not upload private or abusive footage to an unknown detection website.
- Preserve the original file and calculate a hash when chain of custody matters.
- Record tool names, versions, thresholds, and conflicting results.
Act safely when the answer remains uncertain
Classify the result as corroborated, misleadingly edited or captioned, likely synthetic, or unresolved, and list the evidence. Avoid publishing a person’s name beside a detector percentage. For fraud, preserve messages and transaction details, contact the impersonated person through a trusted route, notify the platform, and report financial loss promptly to the institution and relevant authority.
For intimate deepfakes, prioritize the targeted person’s safety and dignity. Do not forward the media to recruit amateur opinions. Preserve URLs and limited evidence as advised, use platform reporting and applicable support channels, and seek legal or victim-services guidance where appropriate. The goal is to stop harm and establish facts, not maximize exposure to the suspected clip.
- Use “unverified” when evidence does not justify a binary label.
- Correct earlier sharing prominently if the assessment changes.
- Keep urgent real-world decisions on a separately authenticated channel.