Viral photos fail in two ways: they're AI-generated, or they're real photos from a completely different event. An AI detector catches the first. A reverse image search catches the second. Neither alone is enough — but both together, plus a metadata check and source contact, cover the majority of misleading images circulating in 2026. Here's the full workflow, in order, under two minutes.
Run this first because it's the fastest check and eliminates a full category of fake. If the image is AI-generated, no further verification is needed — it's not a real photo of anything.
FauxSpy (Chrome/Firefox extension): right-click the image in Chrome → "Check with Faux Spy." Result in under one second. If the image was downloaded and you're working from a file, open it in any tab and right-click from there.
Illuminarty (web, upload): drag the image to illuminarty.com. Takes 3-5 seconds but returns a heatmap overlay showing exactly which regions triggered the AI verdict — useful if you need to document the finding for an editor or legal review.
If the result is "Likely AI" — stop. If the result is "Inconclusive" or "Likely Real," continue. An Inconclusive result means the detector couldn't find strong AI signals, not that the photo is necessarily authentic. Proceed to reverse image search.
Important: AI detection only catches AI-generated images. A real photo from 2019 reposted as if it depicts a 2026 event passes the AI detector — it is a real photo. Real photos used out of context are arguably more common than fully AI-generated news fakes. Always proceed to the remaining steps.
Run all three engines — they have different coverage and one will often find results the others miss:
If the image appears dated before the event it's claimed to show: definitively misattributed. If it appears on another story with a different context: needs source investigation. If it returns no results: either genuinely new (possible for breaking news) or AI-generated with no prior web presence (consistent with Step 1 findings).
Use exifdata.com or Jeffrey's Exif Viewer to inspect the image file's embedded metadata. Key fields:
Camera Make/Model
AI-generated images have no camera data. A photo with "Canon EOS R6" listed was captured by that specific camera. Absence isn't proof of AI (metadata gets stripped by platforms), but presence with consistent data is a positive signal.
GPS Coordinates
If present, check in Google Maps. Does the GPS location match the claimed location? Significant mismatch is a red flag. GPS can be edited, but most casual photo manipulators don't bother.
Timestamp
DateTimeOriginal shows when the photo was taken. Cross-reference with the claimed event date. A photo timestamped three years before the event it allegedly shows is strong evidence of misattribution.
Visit verify.contentauthenticity.org (the official CAI verification tool) and drop the image. If C2PA credentials are present and valid, you'll see the chain of custody: who captured it, with what device, what edits were applied, and by whom.
Critical caveat: most images shared on social media have C2PA credentials stripped during upload. Absence of credentials does not mean the image is inauthentic. Credentials are most likely to be present on images shared directly from C2PA-enabled cameras (Canon, Nikon, Leica) or AI generators (OpenAI, Adobe Firefly) without being routed through social platforms. See: What is C2PA?
If steps 1-4 haven't definitively answered the authenticity question, contact the primary source directly. For images sent by freelancers or citizen journalists: request original high-resolution file, request original device, look for metadata consistency. For images circulating on social media: identify the earliest poster and contact them. Cross-reference scene details against what's verifiably known about the event: architecture, weather, crowd clothing, visible text in signs.
The AP's Digital Authenticity Verification Workflow and the First Draft verification guides provide detailed frameworks. Steps 1-4 are the automated pre-screen; Step 5 is where editorial judgment applies.
The standard workflow: (1) AI detection with FauxSpy or Illuminarty; (2) reverse image search on Google Images, TinEye, and Bing; (3) metadata inspection for camera data and GPS; (4) C2PA credential check at verify.contentauthenticity.org; (5) primary source contact and contextual verification. AI detection catches generated images; reverse search catches miscontextualized real ones; steps 3-5 establish chain of custody.
No. AI detectors catch generated images but not real photos used in false context. A genuine photo from a different country or year passes an AI detector — the detection is correct (it is a real photo) but the context is false. AI detection is one layer of a multi-step process. Reverse image search, metadata, and source verification catch miscontextualized real photos.
AI detection: FauxSpy (browser extension, no account, free) or Illuminarty (web upload, free ~5/day, heatmap documents which regions flagged). Reverse image search: Google Images, TinEye (best for finding earliest posting date), Bing Visual Search. Metadata: Jeffrey's Exif Viewer or exifdata.com (both free). C2PA credentials: verify.contentauthenticity.org (free, official CAI tool).