How to Spot AI-Generated Images and Deepfakes

A convincing fake photo can now be made in seconds, and a cloned face or voice can appear in a video call or a forwarded clip. Learning how to spot AI-generated images is no longer a niche skill: it protects you from scams, stops you passing on false news and helps if your own face is misused. The uncomfortable truth is that your eyes alone are not reliable. This guide gives you a method instead: check the context, trace the image, look for provenance data, then look for visual clues, and know where to report harmful deepfakes in India.

Why your eyes are not enough

In a 2022 study published in PNAS, researchers Nightingale and Farid asked participants to classify faces as real or AI-generated. The synthetic faces were made with StyleGAN2. Average accuracy was 48.2%, close to the 50% expected by chance. With training and feedback, accuracy rose only to 59.0%. Participants also rated the synthetic faces as slightly more trustworthy than real ones, 7.7% higher on average (Nightingale and Farid, PNAS, 2022).

Image generators have improved since then. So treat "it looks real to me" as no evidence at all, and use the steps below in order. The early steps are quicker and often more decisive than staring at the picture.

Ask where an image came from before you ask what is wrong with it.

Step 1: Check the context

Most fakes are spread for a reason: to make you angry, frightened, generous or quick to forward. Before looking closely, ask:

Who posted it first? A named news organisation, an official account or an anonymous forward with no source?
Is anyone else reporting it? A real dramatic event is usually photographed by many people from different angles.
Does it push you to act now? Urgent requests for money, OTPs or "share before it is deleted" are warning signs whether the image is real or not.
Does the caption match the picture? Many misleading posts use a real photo from a different time or place, which is a different problem from AI generation but just as harmful.

Step 2: Trace the image

A reverse image search shows where else a picture has appeared. Google's "About this image" feature, available in some regions, shows when Google may first have seen the image or similar ones, other pages that use it, earlier uses where available, and metadata about how the image was made or edited, such as whether a camera captured it or AI generated it. You reach it from the Image Viewer by choosing About, then "Learn more about an image" (Google Search Help).

Google adds an important warning on the same page: "credit and digital source type metadata can be modified with image generation and editing tools, so it may not be accurate." Use the metadata as one clue, and look for fact-checks or the original source among the results.

Step 3: Look for provenance data and watermarks

Content Credentials (C2PA)

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open technical standard for recording where digital content came from and how it was edited. Its Content Credentials are described as working "like a nutrition label for digital content". Its steering committee includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic (C2PA). You can upload a file to the Content Credentials Verify tool to see any credentials attached to it.

Read the result carefully. The C2PA explainer says Content Credentials "do not provide value judgments about whether a given set of provenance data is 'true'", and that provenance information alone "cannot tell you whether the digital content is true, accurate or factual". It also notes that provenance metadata can be removed, that adding credentials is optional, and that "no assumption should be made about the trustworthiness of a particular asset" just because it does or does not carry them (C2PA Explainer 2.4). In practice, many images you come across will show no credentials at all, because adding them is optional and they can be removed along the way. To help with that, C2PA supports "soft bindings" such as invisible watermarks or fingerprints that can help rediscover a credential after it has been removed from the file (C2PA FAQ).

SynthID

Google DeepMind's SynthID embeds an invisible watermark in images, video, audio and text generated by Google's AI tools. Google says the image and video watermarks are designed to survive cropping, filters, frame-rate changes and lossy compression. You can ask Gemini, Google Search or Chrome whether a file was created or altered with Google AI, or use the SynthID Detector portal, which Google says also checks content from partners including OpenAI, NVIDIA and Kakao (Google DeepMind, SynthID).

Check	What a positive result tells you	What a negative result tells you
Content Credentials	Who signed the file and what tools were recorded, including AI generation if declared	Very little: credentials are optional and often stripped
SynthID	The content was made or altered with Google AI or a participating partner	Only that no SynthID watermark was found; other generators may have been used
About this image metadata	Metadata says AI was involved	Metadata may be missing or edited

Step 4: Look for visual clues

Only now is it worth zooming in. MIT Media Lab's Detect Fakes project lists cues for spotting manipulated faces in video (MIT Media Lab, Detect Fakes):

The face: high-end deepfakes are almost always facial transformations, so focus there.
Cheeks and forehead: does the skin look too smooth or too wrinkly, and is its apparent age consistent with the hair and eyes?
Eyes and eyebrows: do shadows fall where the lighting suggests they should?
Glasses: is there glare, too much glare, and does it shift naturally as the head moves?
Facial hair and moles: do they look real, or added and removed?
Blinking: does the person blink too little or too much?
Lips: do mouth movements match the words?

The same habit of checking consistency applies to still images: compare shadows with the light source, look at reflections, check whether text on signs and labels reads correctly, and look closely at hands, ears, jewellery and the edges where hair meets the background. None of these is proof on its own. Real photos can look strange because of compression, beauty filters or motion blur, and newer generators avoid many older giveaways.

Step 5: Treat voice and video calls with extra care

Deepfakes are not just viral images. Cloned voices and faces are used in calls that ask for money urgently. A few habits help regardless of how good the fake is:

Hang up and call the person back on a number you already have.
Agree a family code word or question that a stranger could not answer.
Never share an OTP, PIN or password on a call, however familiar the voice sounds.
In a video call, ask the person to do something unplanned, such as turning their head or holding up a specific object, and watch the lips and blinking cues listed above.

The rules in India and the EU

India: the 2026 IT Rules amendment

According to a Government of India press release from August 2026, the Government amended the IT Rules, 2021 on 10 February 2026 to deal with synthetically generated information, including deepfakes. Key points (PIB, Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes):

Platforms must ensure clear labelling and traceable metadata for permissible AI-generated content.
Platforms must use reasonable technical measures to stop users creating or sharing synthetic content that breaks the law, and the rules explicitly cover child sexual exploitation material, non-consensual intimate imagery and impersonation.
The time to remove unlawful content after a court order or a valid government notice was cut from 36 hours to 3 hours.
Grievance timelines were shortened, including from 24 hours to 2 hours for sensitive matters such as nudity and impersonation.

The same release lists existing laws that apply to deepfake misuse, including sections of the IT Act covering identity theft (66C), impersonation (66D), privacy violations (66E) and obscene content (67, 67A), and sections of the Bharatiya Nyaya Sanhita on cheating by personation (319) and forgery (336).

The EU AI Act

Article 50 of the EU AI Act requires providers of AI systems that generate synthetic audio, images, video or text to mark outputs "in a machine-readable format and detectable as artificially generated or manipulated", and requires those who deploy deepfakes to disclose that the content has been artificially generated or manipulated, with lighter rules for clearly artistic, satirical or fictional work. The article was set to apply from 2 August 2026 (EU AI Act, Article 50). For Indian readers, this matters because many of the apps and platforms you use operate in the EU too, so labels and watermarks are likely to become more common everywhere.

If you make AI images or video yourself, the same logic applies in reverse: label your work clearly and keep any credentials your tools attach. Our roundup of AI agents for automating video editing covers tools you may already be using, and running models on your own machine, as described in our guide to running AI models locally, does not remove your responsibility to disclose synthetic content.

If you are targeted by a deepfake

Save evidence: screenshots, links, usernames, dates and times, before the content is deleted.
Report it on the platform using its impersonation or non-consensual imagery option, and note the complaint number.
Report it to the authorities on the National Cyber Crime Reporting Portal or by calling the 1930 helpline. The Government's release says deepfakes, financial fraud and content misuse are all reportable there.
Appeal if needed: if a platform's grievance officer does not resolve your complaint, the same release says you can appeal online to a Grievance Appellate Committee.
Get support: tell someone you trust, and consider legal advice if the content is defamatory or sexual in nature.

The bottom line

You cannot reliably spot AI-generated images by looking alone; even trained people perform only a little better than chance. Use a routine instead: question the context, trace the image with a reverse search, check for Content Credentials and SynthID, and only then look for visual clues, remembering that a missing label proves nothing. Verify urgent calls through a second channel, and report harmful deepfakes to the platform and at cybercrime.gov.in or 1930.

Frequently asked questions

Can AI detectors tell me for certain if an image is fake?

No. Provenance tools such as Content Credentials and SynthID can confirm some AI-made content, but a negative result only means no marker was found. Percentage-score detectors should be treated as weak hints.

If an image has no Content Credentials, is it fake?

No. The C2PA explainer says credentials are optional and can be removed, and that no assumption about trustworthiness should be made from their presence or absence alone.

Are deepfakes illegal in India?

The Government's 2026 release does not treat AI-made content as unlawful in itself, but using it for impersonation, fraud, forgery, obscenity or privacy violations is covered by the IT Act and the Bharatiya Nyaya Sanhita. Since February 2026, platforms must also label permissible synthetic content and remove unlawful content faster.

Where do I report a deepfake in India?

Report it to the platform first, then on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline. If the platform does not act, you can appeal to a Grievance Appellate Committee.

Sources

AI-synthesized faces are indistinguishable from real faces and more trustworthy, Nightingale and Farid, Proceedings of the National Academy of Sciences, 2022.
Learn more about an image, Google Search Help, accessed 2026.
Coalition for Content Provenance and Authenticity, C2PA, accessed 2026.
C2PA and Content Credentials Explainer 2.4, C2PA, accessed 2026.
C2PA FAQ, C2PA, accessed 2026.
Content Credentials Verify, Content Authenticity Initiative, accessed 2026.
SynthID, Google DeepMind, accessed 2026.
Detect Fakes, MIT Media Lab, accessed 2026.
Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes, Press Information Bureau, Government of India, 2026.
Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems, EU Artificial Intelligence Act (artificialintelligenceact.eu), accessed 2026.
National Cyber Crime Reporting Portal, Government of India, accessed 2026.