Image generators have crossed the threshold where casual inspection fails. But "impossible to spot casually" is not "impossible to spot" — a structured check still catches most fakes, and matters for finance teams more than most people realize: manipulated images now appear in invoice fraud (doctored invoices, fake remittance letters), fake ID documents in onboarding, and fabricated "proof" photos in supplier disputes.

The 8 checks, in order

  1. Provenance beats forensics. Ask where the image came from before analyzing pixels. Reverse-image search it; an image that only exists in one place, sent by the person who benefits from it, starts suspicious.
  2. Text and numbers. Generators still mangle small text — letterheads, invoice line items, serial numbers. Zoom into every character.
  3. Geometry and reflections. Check that shadows agree on a light source, reflections match the scene, and straight lines (table edges, door frames) stay straight through the background.
  4. Hands, ears, teeth, jewelry. Still the classic failure zones in generated people — asymmetric earrings, fused fingers, irregular teeth.
  5. Texture uniformity. AI images often have a subtle over-smoothness — skin without pores, fabric without weave — or the opposite, hallucinated detail that repeats in tiles.
  6. Metadata (EXIF). A real phone photo carries camera model, timestamps, and often GPS. Absent metadata proves nothing (platforms strip it), but present, coherent metadata is a positive signal.
  7. Content credentials (C2PA). A growing share of cameras and editors cryptographically sign capture and edit history. Verify credentials when present — this is the direction the industry is moving.
  8. Run a detector — and treat it as one vote. Automated AI image detectors analyze statistical fingerprints invisible to the eye. They're genuinely useful and genuinely fallible: compression, resizing, and novel generators degrade accuracy. Use the score to decide how much human scrutiny to apply, not as a verdict.

For finance teams: the process answer

The same principle that governs voice applies to images: detection triggers verification, it doesn't replace it. A suspicious invoice image shouldn't start a forensics debate — it should trigger the callback protocol: verify the request with the counterparty on a number already on file. Pixels can be argued about; a verified callback can't.

Protocol tipNever accept an image as the sole evidence for a payment-affecting decision. Documents prove less than they used to; verified conversations prove as much as ever.