How to Verify Suspicious Media Before You Share or Act on It

How Do You Verify Suspicious Media Before Sharing It?

Start by not sharing it. A forwarded fake spreads faster than any correction, and resharing also strips context that would help you check it later. Then work through the steps below in order. Most items resolve within the first four, and the later ones are for cases where a wrong answer would cost money, safety or someone's reputation.

The order is borrowed from professional fact-checking. Mike Caulfield's SIFT method, published in June 2019, condenses it into four moves: Stop, Investigate the source, Find better coverage, and Trace claims, quotes and media to their original context. The list here expands SIFT with the evidence-handling and callback steps that fraud and security teams need.

• Pause, and note your own reaction. Urgency, outrage and fear are what manipulated media is designed to produce.
• Save the item as received: the file, the link, the account or phone number that sent it, the time, and any message attached.
• Write down the claim in one sentence: who, what, when, where, and what you are being asked to do.
• Investigate the source: is the account real, how old is it, and has it posted reliably before?
• Find better coverage: do reputable outlets, the organization involved or official channels report the same thing?
• Trace the media: run a reverse image or keyframe search, compare with the earliest copy, and check for Content Credentials or other provenance data.
• Confirm out of band: contact the person or organization shown through a channel you already have, not one supplied in the message.

How Much Checking Does a Suspicious File Need?

Scale the effort to the consequence of being wrong. A meme you were going to share with friends needs a minute. A voice note asking you to move company money needs a callback no matter how real it sounds. A video that may be used in a disciplinary case or court needs evidence handling from the first minute.

Why Isn't Looking for Glitches Enough?

Visual tells are unreliable in both directions. In a pre-registered experiment published in iScience in November 2021, Nils Köbis, Barbora Doležalová and Ivan Soraperra found that 210 participants identified deepfake videos with 57.6% accuracy, and that financial incentives and warnings did not improve their scores. Participants called 67.4% of the clips authentic even though half were fake, and those who performed worst were the most overconfident.

Genuine media also produces glitches. Low light, video call compression, beauty filters, frame interpolation and dropped packets distort faces, edges and lip sync in real recordings. The FBI's December 2024 alert still lists visual flaws such as distorted hands, irregular faces and mismatched voices as warning signs, and they are worth noticing, but a clean-looking video is not evidence that it is real. The source and the context carry more weight.

How Do You Verify a Suspicious Call, Voice Note or Video Message?

Treat the request and the media separately. Even a perfect analysis of a voice note cannot tell you whether the person really wants you to send money, so confirm the request through another route. The FBI's Internet Crime Complaint Center, in its 3 December 2024 announcement on generative AI fraud, advises families to agree on a secret word or phrase, and everyone to hang up and contact the organization directly using a number found independently.

In organizations the same principle becomes policy: callbacks to directory numbers, dual approval for payments over a threshold, and no changes to bank details or credentials during the call that requested them. The January 2024 Arup case, in which a Hong Kong employee transferred HK$200 million after a video call populated by deepfake recreations of colleagues, began with an email the employee doubted. A callback to the real chief financial officer would have broken the chain.

How Should You Preserve Suspicious Media as Evidence?

Preserve before you analyse. Download the original file rather than a screenshot or screen recording, which discards metadata and adds a new layer of compression. Record the URL, the account handle and ID, the message thread, and the date and time you collected it. Compute a hash of the file so you can later show it has not changed, and keep a log of who handled it.

Then work on copies. Every conversion, crop or re-upload changes the file and can erase traces a forensic examiner would need. If the platform may delete the content, capture the surrounding page as well. These steps cost a few minutes and decide whether the file can later support a claim, a complaint or a correction.

When Should You Use a Deepfake Detection Tool?

Use a detector when the earlier steps leave the question open and the answer matters, for example a new image with no earlier copies, a recording offered as evidence, or a video of an executive circulating before an announcement. Detection examines the content itself, so it is the one check that works on media with no history, no provenance and no reachable subject.

Read the result as evidence with limits. Ask what modality the tool tested, what file quality it received, what threshold it used, and how it performs on media like yours. Deepfake-Eval-2024 (arXiv 2503.02857), built from deepfakes that circulated in 2024, found open-source detectors lost about half their AUC on video compared with older benchmarks, so a free tool's verdict on a compressed clip deserves caution.

How Does Neural Defend Support Media Verification?

NeuroDetect is the forensic workspace for the final step. An investigator uploads an authorized image, audio file, video or document into a case. The analysis keeps the model and version context, and explainability heatmaps and attention views point to the regions, frames and audio segments behind each finding. An LLM-assisted summary describes the result in plain language with links to that evidence, and the analyst makes the final call.

The case exports as a forensic report covering observations, uncertainty, provenance, model context and analyst notes, which suits newsrooms, fraud teams and investigators who must show how they reached a conclusion. Detection runs on ARCAS 1B, Neural Defend's own detection model, and Neural Defend ranked first of 36 systems on the public VendorBench-100 still-image benchmark with an MCC of 0.876. For organizations that need verification at scale, the same detection is available as an API through NeuroVerify.