Spotting deepfakes: why “look at the hands” is no longer enough

Six fingers on a hand. Blurry earrings. Background text that makes no sense. You’ve probably seen the checklists: how to spot an AI-generated image. The bad news: those checklists age faster than they’re written. The good news: there is an approach that actually holds up. That’s what this article is about.

Why the detection tricks keep getting weaker

The classic tips are based on mistakes AI models made at a particular moment in time. Odd hands, illogical shadows, strange teeth, glitchy lip movements in video, a metallic edge in cloned voices. All of those cues came with an expiry date, because every new model generation fixes exactly the flaws the previous one was known for.

That’s not a coincidence — it’s the mechanism itself. These models are trained and refined until their output is no longer distinguishable from the real thing. Every publicly known detection trick is, in effect, a to-do list for the next version. If your judgement rests on “I’ll spot it in the details”, it rests on sand.

Does that mean you can never tell anything from an image anymore? No — sloppy or cheap fakes still give themselves away regularly. But you can no longer assume that a convincing image must therefore be real. And that is exactly the mental shift to make.

From pixel-peeping to provenance

The durable question is not “does this look real?” but “where does this come from?”. Professional fact-checkers have worked this way for years: the evidence isn’t the image itself, it’s the trail around it.

Questions that keep working

• Who published this first? A reputable outlet with a name and accountability, or an anonymous account created yesterday?
• Are other, independent sources reporting the same thing? Real news almost always surfaces through multiple independent sources. If a shocking image exists in only one place, that’s a signal.
• Does the context hold up? A lot of misinformation isn’t even AI: a real image from a different year or country, given a new caption. A reverse image search (via Google Lens or TinEye, for example) often shows where an image appeared before.
• Who benefits if you believe this? Images engineered to trigger anger or fear deserve extra suspicion — precisely because they may have been made to be shared.

Technical provenance standards are also being developed — watermarks and metadata that record how an image was made (known from initiatives like C2PA/Content Credentials). Useful where it works, but far from universal and not watertight: metadata can be missing or stripped. Treat it as an extra clue, not a final verdict.

What about AI detection tools?

Tools exist that claim to detect AI images or AI audio. By all means use them as one signal among several, but don’t trust them blindly. They get it wrong regularly — in both directions: genuine images get flagged as fake, and new generations of fakes slip through. A detector score is a clue, not proof.

What to do when you’re unsure

The skill that lasts: verify via a second channel

Deepfakes become truly dangerous when they target you. Think of a cloned voice that sounds like your child or your mother, asking for money. Or a “video call with the director” urgently requesting a payment — a type of fraud that police forces and banks have been warning about for a while now.

No visual trick protects you against these attacks. What does help is simple and old-fashioned: verify via a second, independent channel.

• Getting an unexpected, urgent request by phone, voice message or video? Hang up and call back yourself on the number you already had for that person — not on a number from the message itself.
• Is “your bank” or “a colleague” asking for a transfer or login details? Make contact through the official channel that you look up yourself.
• Agree within your family or team how you check with each other on money matters — for example: any unexpected payment request means calling back first, every time.

Why is this the durable skill? Because it assumes nothing about how good the fake is. Even if the fake voice gets ten times better tomorrow: a scammer imitating your mother won’t pick up when you call your real mother back. Second-channel verification doesn’t age along with the technology.

Talk about it with your family and your team

This skill only really works when the people around you know it too. Older family members are a favourite target of voice-clone scams; children share images faster than they check them. So go through the call-back agreement together at home, and agree at work how payment requests and password requests get verified. One ten-minute conversation can make the difference.

In short

Spotting fakes by their pixels: less and less reliable. Checking provenance: durable. Not sharing when in doubt: always right. And for anything involving money, credentials or urgency: verify through a channel that you choose.

Curious how well you already see through fake content? Take the free AI literacy quiz. In the AI literacy course you practise these skills step by step, and in AI and your child you’ll find how to discuss this with your kids. For teams that want to take this seriously, see our page for employers.