A deepfake is synthetic audio, video or imagery made with machine learning that shows a real person saying or doing something they never said or did. The word is a mashup of "deep learning" and "fake," and it started as a niche term around 2017. It is now a normal thing for a newsroom to have to rule out before publishing. * The useful question is not "how do I spot a deepfake by looking at it." That advice — count the fingers, check the ears, look for weird blinking — was already unreliable and gets worse every model release. The useful question is the one verification desks actually ask, which has almost nothing to do with staring at pixels. * WHAT A FAKE COSTS WHEN NOBODY CHECKS * Two concrete cases, because the stakes are not theoretical. * On May 22, 2023, an AI-generated image purporting to show an explosion near the Pentagon spread from a since-suspended verified Twitter account posing as a Bloomberg feed. Just after 10 a.m. New York time, the S&P 500 dropped about 0.3% to a session low and the Dow fell roughly 80 points between 10:06 and 10:10 a.m., recovering by 10:13 once the Pentagon Force Protection Agency confirmed there had been no explosion (Bloomberg, May 22, 2023). One bad image, four minutes, real money. * In January 2024, thousands of New Hampshire voters got a robocall in what sounded like President Joe Biden's voice telling them to skip the Democratic primary. The FCC fined political consultant Steve Kramer $6 million for it, and Lingo Telecom, the carrier that carried the calls, settled with the FCC for $1 million with a compliance plan (FCC, 2024). Notably, a New Hampshire jury acquitted Kramer of the state criminal charges in June 2025 (NHPR, June 13, 2025) — a reminder that the technical fact of a fake and the legal consequence of one are two different things. * WHAT VERIFICATION DESKS ACTUALLY DO * Serious verification is boring and mostly non-visual. The order looks roughly like this. * 1. Find the earliest version, not the loudest one. Almost everything you see has been reposted, re-encoded and cropped. Verification starts by tracing the file back toward its first public appearance — the account, the timestamp, the platform. A clip whose "original" post is three days after the event it claims to show is already in trouble. * 2. Get the original file. Re-encoding destroys almost everything useful. Desks ask the uploader for the untouched file, which carries metadata, camera fingerprints and compression artefacts that survive nothing else. * 3. Check the physical world, not the face. This is where open-source techniques take over: does the skyline match, do the shadows match the sun angle for that date and location, do the road markings, plug sockets, licence plates and shopfront alphabets belong to the country in the caption. A model can render a convincing face far more easily than a convincing street. * 4. Ask who benefits and who else has it. If a video would be the single most important piece of evidence in a major story and exactly one anonymous account has it, that is not a scoop, that is a warning. * 5. Call the person. The dullest step and the most decisive. A press office confirming or denying a specific clip beats any amount of pixel forensics. * 6. Only then, tools. Detection classifiers exist and desks do run them, but they are treated as one input, not a verdict — they degrade badly on compressed social-media video and produce both false positives and false negatives. Any outlet that publishes "an AI detector said it was 92% fake" as the whole story is telling you it did steps 1 to 5 badly. * THE RECEIPT APPROACH: CONTENT CREDENTIALS * Because proving a thing is fake is hard, the industry has shifted toward proving a thing is real. That is the C2PA — the Coalition for Content Provenance and Authenticity, founded in 2021 out of Adobe's Content Authenticity Initiative and the Microsoft/BBC Project Origin, with a steering committee that now includes Adobe, Amazon, the BBC, Google, Intel, Meta, Microsoft, OpenAI, Sony and Truepic. * The output is Content Credentials: tamper-evident metadata attached to a file recording where it came from and what was done to it. Leica and Nikon have shipped cameras that write credentials at the moment of capture; Adobe and OpenAI attach them on the editing and generation side; BBC News has embedded them in published images. * The limits are as important as the promise. Credentials are voluntary, they can be stripped by any platform or tool that does not preserve them, and a signed file only proves provenance — not that the caption is honest. A perfectly credentialed real photo can still be published under a lying headline. Provenance answers "was this file made where it says it was," not "is this story true." * WHAT THIS MEANS FOR YOU, PRACTICALLY * Skip the artefact-hunting. Three habits do more work than any visual tell. * First, check who else has it. A genuinely major event has multiple independent sources within hours — other outlets, other angles, an official statement, a local reporter. A world-changing clip that exists on exactly one account and nowhere else is the classic signature of a fake, and it has been for years. * Second, read the sourcing line rather than the video. "Verified by" with a named desk means someone put their name on it. "Unverified footage circulating on social media" means the outlet is publishing something it has not confirmed and telling you so in the smallest available font. * Third, notice the direction of your own reaction. The fakes that travel are the ones that confirm what an audience already believes and arrive when checking feels unnecessary — two days before an election, an hour into a crisis. If a clip makes you feel instantly and completely vindicated, that is exactly the moment to wait an hour. * There is also a second-order problem worth naming: the liar's dividend. Once everyone knows video can be faked, anyone caught on real video gets a free defence — "that's AI." Detection technology cannot fix that. Only sourcing can: knowing who recorded a thing, who published it, and who is willing to be held responsible if it turns out to be wrong.