Deepfake or real? A defensible verification process for decision-makers

Manipulation does not need to be fully synthetic. Authentic video can be falsely captioned, cropped, revoiced or reused from another event. Conversely, edited material can still depict the core event accurately.

The operational question is therefore not only how a file was produced, but which claim is being made with it and whether that claim is supported by reliable evidence.

Avoid unnecessary redistribution before analysis. Recompression and editing may change technical traces, while posts, profiles and stories can disappear quickly.

• Secure the original or best available file, not only a screenshot.
• Record the URL, account, timestamp, accompanying text and discovery context.
• Limit internal circulation to those who need access.
• Write the exact claim to be tested in one sentence.
• Assign communication and escalation responsibility before responding publicly.

The order matters. Looking for visual flaws too early narrows the analysis to the media file and can hide stronger contextual evidence.

1. 01
   Source

   Who published the material first, and is that channel authentic, current and competent to make the claim?

2. 02
   Provenance

   Is there an original file, metadata, content credential or traceable edit history?

3. 03
   Context

   Do location, weather, clothing, language and known timelines fit the claimed situation?

4. 04
   Content

   Which visual, audio or motion anomalies exist, and could compression, perspective or editing explain them?

5. 05
   Corroboration

   Do independent recordings, witnesses, official sources or primary evidence support the core claim?

Automated detection can provide a useful signal, but performance depends on training data, manipulation type, compression and unknown generation methods. A percentage looks precise while saying little without model version, test conditions and error rates.

Use detectors as indicators: ideally several methods, controlled inputs and documented versions. A positive signal needs corroboration; a negative one does not prove authenticity.

C2PA can carry cryptographically bound information about origin and editing. This helps determine whether a signed provenance record belongs to a file and whether documented changes occurred.

It is a strong trust signal, not a universal truth label. Authentic signed media can be miscaptioned, and genuine files can lose provenance data through platform processing.

A professional result may not be simply real or fake. It may say: origin unconfirmed, context partly verified, no decisive manipulation indicators, core claim corroborated by two independent sources.

That language prevents both an impulsive reaction to manipulated content and the dismissal of authentic evidence as an alleged deepfake.