An image lands on your phone. A familiar face where it shouldn't be, a politician saying something they never said, someone in your family asking for money in a voice that sounds exactly like theirs. The reflex, these days, is almost always the same: drop the image into an app that promises to tell you, in one word, whether it is real or fake. That is where the trouble starts.
That number the app spits out, "97% fake", "synthetic image", is not proof. It is a lead. And treating a lead as a verdict is the fastest way to be fooled with a clear conscience. The right question was never "is this fake?". It is "can I rely on this image, or on this part of it?".
Europe's own AI regulation defines a deepfake, an image or video generated or altered by AI that looks authentic to whoever sees it, around a word that tends to slip by: "manipulated". A deepfake is not necessarily a whole image invented from scratch. Often it is a real photograph in which only one thing changed, a swapped face, an added object, a shadow that was never there. And that detail is exactly what a "real or fake" button misses, because it is judging the whole image at once.
This person does not exist: the face was entirely generated by an AI model. It is exactly what looks authentic that fools us. Image: Wikimedia Commons, public domain.
Why the detector fails right where it matters most
Automated detectors are systems trained to recognise patterns they have seen before. They advertise accuracy above 90%, but that is in the lab, on clean images. The photo that reaches you went through WhatsApp, through Instagram, was recompressed half a dozen times, and that compression wipes out precisely the microscopic traces the detector learned to look for. On the images that actually circulate, accuracy collapses.
The rest is worse. These systems produce false positives, flagging the real as fake, and false negatives, letting the fake through. They fail against generation methods they have never seen. And some people build deepfakes specifically to fool the detector. That is why a result like this, on its own, does not hold up in court and should not hold up your decision either.
How a suspect image is actually examined
People who investigate this properly do not press a button. They cross several independent signals and document every step, so that someone else can repeat the examination and challenge it. They start with the metadata, the invisible history a file carries: when it was created, with which software, whether it passed through an AI tool. They look at compression traces, because an area compressed differently from the rest betrays that something was pasted in. They check the physics of the scene, a shadow falling the wrong way, a reflection that does not match, a halo around a cut-out face. They go down to the noise and texture at the pixel level, which the naked eye cannot see. And they only conclude when several of these signals point the same way.
The same photograph saved at different compression levels across the image: the more compressed left side breaks up into blocks. It is this variation in compression history that forensics reads to find regions edited, or pasted, separately. Image: Michael Gäbler and AzaToth, Wikimedia Commons, CC BY 3.0.
This is the logic of the chain of custody. Evidence only holds up when it leaves a trail any competent person can follow, repeat and challenge. Portugal still has no specific law for deepfakes, but there is already plenty to act on: civil law protects your right to your own image, criminal law covers fraud, defamation and computer forgery, and data protection law treats your face and your voice as what they are, personal data that belongs to you.
How to defend yourself, in practice
You do not need to be an expert to protect yourself. You need to change the order of the questions:
- Doubt the context before the pixel. Who is messaging, why the rush, why the request for money or a code. A deepfake almost never arrives alone, it comes wrapped in a scam built on urgency.
- Do not hand the decision to a single detector. If an app says "fake", treat that as a reason to investigate, not as proof.
- Find the original. Run a reverse image search and check whether a primary source exists and says the same thing.
- Look at the local details. Hands, teeth, ears, jewellery, text in the background, shadows and reflections, that is where AI still stumbles.
- Save everything and report it. Links, screenshots and dates, and file a complaint with the authorities.
The mandatory labelling of AI content that Europe's regulation will impose helps, but it does not excuse you from thinking. As long as someone wants to deceive you, there will be images with no label. The defence is not finding the right button. It is recovering the habit of asking, before you believe, whether what you are looking at has earned your trust.
Source: Forensic Focus.
#StaySafe
🙏🖖
