How to Check If an Image Is AI Generated: Stop Counting Fingers, Start Reading the File

Someone sends you a photo and asks if it is real. You zoom in, count the fingers, look for warped text in the background, check whether the shadows agree with each other.

Two years ago that worked often enough to feel like a skill. In 2026 it is closer to a coin flip, and every model release makes it worse. The good news is that the professional method never involved looking at the picture at all.

Where the actual evidence lives

A generated image usually carries a second layer beyond its pixels — a record of where it came from. Two parallel systems produce that layer, one industry-standard and one legally mandated, and they are structurally similar.

Content Credentials (C2PA). An open standard for attaching a signed provenance record to a file: what made it, what edited it, in what order. Adoption has moved fast — TikTok, which was an early video-platform adopter, took a seat on the C2PA Steering Committee on July 27, 2026, and camera and editing-software vendors have been shipping support.

Regulated implicit labeling. China's AI content labeling rules, in force since September 1, 2025, split identification into two kinds: explicit (text, audio or graphics the user can perceive) and implicit (technical markers added inside the file data, not readily perceptible). The implicit marker is required to carry attributes such as the synthetic-generation property, the service provider's name or code, and a content ID — written into file metadata. We broke down both layers in AI labelling requirements in 2026.

Two continents, two legal traditions, one architecture: a mark you can see, and a mark that travels inside the file. Nobody is squinting at fingers.

The method, most reliable first

1. Check Content Credentials. Open the file in a C2PA-capable viewer or inspector. If a signed record is present, you get the generating tool and the edit chain. This is the strongest single check available to a non-specialist, because the record is designed to be verified rather than guessed at.
2. Read the raw metadata. Open the original file with any EXIF/XMP inspector and look for generator fields, software names, content identifiers. Original file. Not the copy your friend forwarded you.
3. Look at the platform label. If it is on a social platform, check whether an AI label is displayed — either self-declared or applied by the platform. TikTok has stated it labeled over 3 billion pieces of content using credentials, creator tools and its own invisible watermarking.
4. Reverse image search. Not to detect AI, but to find the earliest appearance and the original context. Half of what people ask about is not synthetic at all — it is a real photo from another event.
5. Only then, detectors and eyeballs. They produce a probability. Treat it accordingly.

The direction this does not work in

This is the part that gets left out of every listicle, and it inverts the conclusion, so read it carefully.

Finding provenance data is strong evidence. Finding none is evidence of almost nothing.

Metadata is fragile by nature. A screenshot destroys it. Re-encoding destroys it. Many platforms re-compress on upload and drop it. Copying an image out of a chat app usually drops it. So "I checked and there was nothing" is compatible with three very different worlds: it is a real photo, it is a generated image that was screenshotted, or it came through a pipeline that stripped the record in transit.

Two further boundaries worth stating plainly:

• Detectors are not verdict machines. Accuracy falls off sharply on cropped, compressed or edited images, and the well-known research on AI detection accuracy comes from academic writing, not social media imagery. We went through why that matters in AI detectors are answering a question no platform asked.
• Removing markers is not a grey area. Under China's labeling rules, no organization or individual may maliciously delete, alter, forge or conceal these identifiers, nor provide tools or services to help others do so. This article does not and will not describe removal methods.

If you are the one publishing

The interesting inversion: the method for checking someone else's image is the same method platforms use on yours. Which makes this a two-way lesson.

• Keep your originals. When something you made gets accused of being synthetic, the original file with its intact record is your evidence. Screenshots are not.
• Declare when you should. The publish-time toggle costs seconds, and no platform has published a rule that labeled content is demoted. What is documented is enforcement against undisclosed synthetic content.
• Expect labels you did not request. Editors, upscalers and stock assets can write credentials into your file, which is why people see labels on work they shot themselves — see why that label appeared.
• Never use generated imagery to imply first-hand experience you did not have. That is where the real enforcement sits, on every platform, in every market.

A worked example

Take the common case: a dramatic photo of a weather event circulating with a location caption, and you want to know before you share it.

1. Reverse image search first. This resolves the majority of cases in under a minute, and usually not the way people expect — the image turns out to be a genuine photograph from a different country or a different decade. Wrong caption, real photo is far more common than a convincing synthetic.
2. If it is genuinely new, look for the original posting rather than the copy in front of you, and check whether that post carries a platform AI label.
3. If you can get the original file, inspect it for Content Credentials and generator metadata.
4. If all three come back empty, your honest conclusion is "unverified" — not "real." Say that when you share it, if you share it.

Step 4 is the discipline that separates a useful check from a performance of one. The pressure in a group chat is always toward a verdict, and the accurate answer is frequently that there is not enough information to reach one. "I could not verify this" is a complete sentence and a much better contribution than a confident guess in either direction.

FAQ

Are AI image detectors accurate enough to rely on?

Not as proof. They output a confidence score, and that score degrades substantially once an image has been cropped, compressed, filtered or re-saved — which describes almost everything on social media. Use a detector to decide whether to look harder, never to decide what to publish or accuse. The provenance route is the one designed to be checkable.

Can Content Credentials be faked?

The records are cryptographically signed, so a forged record does not validate the way a genuine one does — that is the point of the design. The realistic failure mode is not forgery but loss: records get stripped in transit far more often than they get faked. Which is another way of saying the same asymmetry — trust what is there, do not conclude from what is missing.

What if I just want to know before I share something?

Then a two-minute version is enough: reverse image search it to find the original context, check whether the platform shows an AI label, and ask whether the source is one you would trust for a text claim. Most misleading images are not undetectable deepfakes — they are real photographs with a false caption, and no provenance tool will catch that. Reading the source is still the strongest check there is.

The takeaway

The honest answer to "how do I check if this is AI" is: read the file, not the picture — and accept that you will often get "unknown" rather than "no."

That is unsatisfying, but it beats the alternative, which is confidently declaring a real photo fake because a hand looked odd. Provenance gives you certainty in one direction only, and knowing which direction that is turns out to be most of the skill.