How to Detect an Edited Photo: Why the Human Eye Is Not a Control

This article is informational only. It does not constitute legal advice or a regulatory recommendation, and does not replace guidance from a qualified lawyer or compliance officer.

To detect an edited photo, don't rely on looking at it: check its error level analysis (ELA) map for localized compression differences, its EXIF metadata for an editing-software trace, and its pixels for clone-stamped repetition, then verify whether the same image already exists elsewhere online. The human eye reliably catches only the crudest edits — skilled manipulation of a photo used for an ID check, a claim, or a listing routinely passes visual review undetected.

Why the human eye fails as a control

Human visual review is not a reliable fraud control because people are bad at exactly the tasks a convincing edit requires: judging shadow physics, noticing localized compression, and remembering what a "normal" version of a scene looks like. This isn't a training problem a sharper reviewer would fix — it's a structural limit of human vision.

In a 2017 study published in Cognitive Research: Principles and Implications, roughly 1,400 participants were shown genuine and manipulated photos of real-world scenes and asked to spot and locate the edit; overall detection performance was described by the researchers as poor, and even when someone correctly flagged an image as fake, they frequently could not point to where the manipulation was. The study, led by Sophie Nightingale working with Hany Farid at UC Berkeley, found detection accuracy rose only when the edit created a large, structurally obvious disruption — a person added or removed, a horizon line bent. Subtler, localized changes — a scar removed from a face, a stain added to a garment, a document photo lightly retouched — sat close to chance, and even correct detections often couldn't be located within the image.

Three factors compound the problem in a real operational queue: resolution (a reviewer on a laptop, viewing a fraction of the photo's native size, can't see pixel-level artifacts that only surface on close inspection or in a forensic overlay), time pressure (onboarding and claims teams review hundreds of images a day, well below the unlimited-time lab conditions above), and no baseline (a reviewer checking a selfie against an ID photo has no "original, unedited" version to compare against — forensic methods don't need one, since they read evidence the file carries on its own).

None of this means visual review is worthless — an obviously swapped face or a comically wrong shadow still gets caught by eye. It means visual review alone cannot be the control for anything a moderately skilled editor produces, which is most of what actually gets submitted.

Clone-stamping and duplicated pixels

A repeated pixel pattern inside part of an image is a reliable sign of clone-stamping, the tool most editors reach for to remove or duplicate a feature such as a scratch, a watermark, or part of a background. Clone-stamping copies a texture from one region and pastes it over another, and because the copied patch is pixel-identical (or near-identical after blending) to its source, it creates a repetition that doesn't occur naturally — fabric weave, carpet texture, or skin pores don't normally repeat exactly.

Free tools such as Forensically run a clone-detection overlay that algorithmically searches an image for matching regions, turning a check that's nearly invisible by eye into a two-second scan. On a manipulated photo, matches cluster tightly around the edited area; on an untouched one, they're sparse and scattered.

A 2024 survey of copy-move forgery detection published in Multimedia Tools and Applications confirms clone-stamping remains one of the most-studied and most reliably detectable manipulation types in image forensics, precisely because the copied region shares statistical properties with its source that block- and keypoint-based algorithms can match automatically.

Error level analysis (ELA)

A region of a JPEG that shows a different compression level than the rest of the photo has almost certainly been altered and re-saved, because an untouched JPEG compresses uniformly across the whole frame. Error level analysis works by re-compressing the image at a known quality level and measuring the difference between that pass and the original file: untouched regions settle into a consistent, low error level, while a region edited and re-saved after the original capture — even one invisible to the eye — restarts from a different compression baseline and lights up on the difference map.

A 2022 peer-reviewed study on tool-based edited image detection using ELA and convolutional networks confirms the mechanism holds up well enough to train automated classifiers on top of it, precisely because a re-saved region's compression signature is measurably different from an untouched one, not just visually different. Our article on error level analysis covers the method in more depth, including its main failure mode: heavy, repeated compression — a photo forwarded several times over a messaging app, for instance — can flatten the whole image toward a similar error level and mask the gap ELA depends on.

EXIF metadata: the Software field

The "Software" field in a photo's EXIF metadata usually names the last application that touched the file, making it one of the fastest checks available — provided the field hasn't been stripped. A photo submitted as "straight from my phone camera" whose metadata lists Photoshop, GIMP, or Snapseed is a concrete, easily verifiable inconsistency that needs no forensic training to interpret.

The UK's Information Commissioner's Office lists EXIF and GPS data among the concrete examples of metadata that can qualify as personal data under UK GDPR, alongside author names and file authorship details — the same fields that, read for fraud purposes rather than privacy purposes, expose an editing tool a claimant didn't mention.

The absence of this field proves nothing on its own, though. Messaging apps, social platforms, and many upload forms strip EXIF metadata by default — including from completely genuine photos — so a missing Software tag is common and unremarkable. Our article on EXIF metadata analysis covers this asymmetry in more detail: the field is useful evidence when it's present and incriminating, and uninformative when it's simply gone.

Lighting and shadow inconsistencies

An object or feature added to a photo rarely casts a shadow that's geometrically consistent with every other shadow in the frame, because matching a new element's shadow to an existing light source requires 3D geometry most photo editing happens without. Hany Farid's research models shadow consistency as a solvable geometry problem: if no single light-source position can account for every shadow visible in a scene, the scene is not physically coherent, and something in it was added or moved after the fact. This makes lighting analysis one of the more durable signals — it doesn't depend on file format, compression, or metadata, only on physics an editor has to get right by eye.

The same limitation applies in reverse: legitimate photos with genuinely mixed lighting can produce shadows that look inconsistent without being edited at all, which is why lighting analysis works best as one signal among several — a point our article on lighting, angle, and framing develops further.

Reverse image search

An image that already exists elsewhere online — on a stock site, a different listing, or an earlier submission — is the most direct evidence available, because it sidesteps the question of whether the photo shows what it claims to show at all. Reverse image search (Google Images, TinEye, Bing Visual Search) can confirm in seconds whether a photo submitted as a fresh capture is in fact reused from a catalog, a previous claim, or someone else's listing.

First Draft's newsroom verification methodology — since adopted in some form by verification desks at the BBC, Reuters, and AFP — treats reverse image search as the standard first step for checking whether an image has prior appearances online, ahead of any deeper metadata or pixel-level analysis.

This signal has one hard limit: it only catches images already indexed somewhere. A photo taken and edited specifically for one submission, never published elsewhere, won't surface in any reverse-search engine — exactly why it needs to sit alongside the checks above, not replace them.

AI-generated and AI-edited images

A photo generated or substantially altered by an AI model behaves differently from a manually edited one, and increasingly can't be told apart from a genuine photo by eye. Farid's more recent work, covered by UC Berkeley's School of Information, puts human ability to distinguish AI-generated images from real photographs only slightly above chance, a trend the UK's National Cyber Security Centre also tracks from the threat side, flagging deepfake and AI-generated content as an increasingly accessible fraud tool. Generative tools don't leave clone-stamp repetition or a re-saved compression region; they produce statistical artifacts in texture and frequency instead, which need model-based detection rather than the classic forensic toolkit above.

This is a distinct problem from photo editing, not a more advanced version of it. AI-generation detection is worth treating as a complement to the editing checks above, not a replacement — a workflow built only around ELA and metadata will miss a synthetic image entirely.

Signals compared

What people actually ask in forums and support threads

Away from marketing copy, the questions people ask in photography forums, marketplace communities, and photo-editing support threads are narrower and more practical than "can AI detect fraud."

"If I flatten and export the file, does that erase the evidence an app would use to detect editing?" No, not by default. Flattening merges layers inside the editing software, but the export step still runs the file through a fresh compression pass — exactly what ELA is built to catch — and most editing tools still write themselves into the Software field on export unless someone deliberately strips metadata as a separate action. This question comes up regularly on Adobe's own community forums, usually from people surprised that a "clean" export doesn't reset the forensic trail.

"Is there any way to detect edited images with total certainty?" No, and any tool claiming otherwise should be treated with suspicion. Every signal above has a documented failure mode, and a careful edit can, in principle, minimize all of them at once. The realistic goal is convergence — several independent signals pointing the same direction, reviewed by a person, not a single check treated as a yes/no answer.

In a real estate context, a related pattern shows up as: "How do I prove a landlord's — or a tenant's — damage photo isn't actually of my property?" Reverse image search plus a comparison against move-in documentation is the first move: a photo lifted from a different listing often surfaces in a search or visibly mismatches fixtures documented elsewhere, which is also why move-in and move-out photo records matter as much as any forensic check after the fact.

Where this shows up across industries

Photo manipulation checks aren't a single-sector concern — the same signals apply, with different stakes, across several use cases:

• KYC and onboarding — an ID photo or selfie used for liveness matching, where an edited image is an identity fraud vector; see banking and KYC.
• Insurance claims — a damage photo edited to inflate a claim, covered in our article on fake damage photos for insurers.
• Rental and real estate — a listing or move-out damage photo; see real estate.
• HR and recruitment — a candidate photo or supporting document; see HR and recruitment.
• Lending — proof-of-address or asset photos that can misrepresent collateral.
• E-commerce — return photos, where the clone-stamp and ELA signals above apply directly to our ecommerce work.

Building this into a workflow, not an automatic verdict

None of the signals above should trigger an automatic rejection alone: a clean file proceeds through the normal process, one isolated signal routes to a documented human review, and multiple converging signals — a clone-stamp match plus a suspicious Software tag, say — justify a deeper investigation. This three-tier structure, detailed in our article on reviewing claim photos at scale, keeps a reviewer in the loop for anything ambiguous while handling clean files efficiently.

Our methodology cross-checks structural coherence, metadata, and localized compression together, rather than judging a photo on a single isolated clue — the same principle the research above supports: no individual signal, human or forensic, is reliable enough to stand alone. An additional layer of AI-generation signals can be enabled depending on the client configuration, on top of the editing-detection analysis described here.

The ACFE 2024 Report to the Nations puts the detection rate for document fraud caught by manual review alone at 37%, with an average detection delay of 87 days — long enough for a well-edited photo to clear several manual checks before a deeper review catches it. Against that backdrop, identity fraud reports to the UK's Cifas National Fraud Database reached more than 237,000 cases in 2023, 64% of all filings that year — a scale that makes a purely visual review process difficult to sustain even before AI-generated content enters the picture.

For teams auditing a document and photo verification process end to end, our document verification guide covers the wider set of controls this sits inside. For AI-generated and synthetic content specifically, our deepfake and AI document fraud detection approach analyses files and surfaces signs of AI-generated content as a complement to your existing controls — never a claim of catching every forgery, but an additional layer worth having as generation tools improve. See our security page or pricing for more detail.

Frequently Asked Questions

Can a person reliably spot an edited photo just by looking at it?

Only for the crudest edits. Academic research on this exact question found detection accuracy close to chance for subtle manipulations, rising only when the edit created a large, structurally obvious disruption such as a bent horizon or an oddly placed shadow running the wrong way.

Does stripped or missing EXIF metadata prove a photo was edited?

No. Messaging apps, social platforms, and many upload forms strip metadata by default, including from completely genuine photos. This signal only carries weight when an editing-software trace is present — its absence means nothing on its own.

Is one suspicious signal enough to reject a photo outright?

No. A single signal — even a visible clone-stamp match — should route to a documented human review rather than an automatic rejection, particularly to keep the decision defensible if it's later disputed.

Do AI-generated images need a different detection method to manually edited ones?

Yes. Manually edited photos leave signs such as clone-stamp repetition or a localized compression gap; AI-generated images typically don't have an "original capture" to have deviated from, so they require model-based detection tuned to the statistical artifacts generative tools produce, rather than the classic forensic toolkit.