Verifying user-submitted photos: what the file can tell a newsroom

Verification desks already use reverse image search, geolocation and source interviews. The file itself is one more source of evidence, often overlooked because most social copies have lost it. When a contributor sends an original, here is what it can and can't tell you.

Ask for the original file

Social platforms and messaging apps strip metadata and re-encode images. A screenshot keeps almost nothing. Ask the contributor to send the original from their camera roll, ideally through a link that receives the file directly. A PIT secure request link does that and records how the photo arrived.

What to check in the file

1. Content Credentials (C2PA). A signed record of how the file was made. Check three things separately: whether the signature is valid, whether the record is bound to this exact file, and whether the signer is on the official C2PA trust lists. All three together are strong evidence of the file's history. See what Content Credentials prove.
2. Camera metadata. Make, model, capture time and settings are consistent with a camera capture. They are easy to change, so compare them with the contributor's account rather than relying on them.
3. Signs of processing. Recompression, resizing or editor tags show the file was handled after capture, which is normal for shared photos and not evidence of manipulation on its own.

Provenance is not the truth of the scene

Even a perfect signed record establishes the file's digital history, not that the scene is what the caption says. A real, unedited photo can be from a different day, place or event. File evidence answers "how was this file made and handled?" Your other verification steps answer "what does it show?"

Report what you can establish, and say what you can't

Readers increasingly understand that "we could not verify" is an honest answer. The same discipline applies to file evidence. If the file has no credentials and no metadata, the right description is "unknown", not "fake" and not "authentic".

How PIT helps a verification desk

PIT reads the file and gives four separate answers: how the image was created, whether it was processed or altered, where it came from, and how strongly that evidence is tied to this file. Each answer lists its evidence and limits, and there is no single real-or-fake score. Signed reports include the file's hash, so an editor or reader can check later that the report matches the file.

FAQ

Can PIT detect any AI-generated image?

No tool can do that reliably from pixels alone. PIT reports AI involvement when the file carries evidence of it, such as a signed AI record, and says "unknown" when it doesn't.

Should we publish the PIT result?

That's an editorial call. If you do, quote the specific finding and its limitation rather than a one-word verdict.