Checking online images: provenance is not a truth verdict

An online image can have a valid provenance record and still be paired with a misleading caption. It can also lack Content Credentials without being fake. Those two distinctions are essential to checking what a post actually establishes.

This is a synthesized verification guide, not an original investigation or a tested ranking of detection products. It draws on Gia Chaudry's April 11, 2026 WIRED reporting about the pressures on online verification, and primary technical documentation checked November 10. The earlier article's timed checklist, vendor shopping list and automatic green-light rules have been removed.

Separate the file from the claim attached to it

Start by writing the claim in a sentence: what supposedly happened, where, when and who is said to be involved. Then record the specific file and post being examined. A statement about the file's editing history answers a different question from a statement about the event.

For example, consider a hypothetical post that labels a photograph as today's flooding in a named town. An intact photograph would not, by itself, establish that date or location. This example describes a reasoning problem; it is not a report of a real image that we analysed.

Keeping the two questions separate also makes a correction more precise. If the date remains unknown, say that the date remains unverified. Do not turn a missing answer into an accusation that the photographer fabricated the scene.

Read what a credential actually records

The C2PA FAQ describes signed provenance data associated with an asset. Credentials can record creation and editing information. Some also reference other source assets, called ingredients. The FAQ cautions that examining an entire ingredient history requires access to those ingredients' data; a reference is not the same as a complete independently inspected chain.

The FAQ also describes credentials that are separated from a file and mechanisms such as watermarking or fingerprinting that can help locate an associated record. That is a supported recovery approach, not a promise that every screenshot, repost or edited copy will retain recoverable provenance.

For the hypothetical flood photograph, the useful result is therefore specific: which record was available, which asset it applied to and which checks completed. Avoid replacing that description with a broad label such as verified news.

Missing, invalid and trusted are different results

The Content Authenticity Initiative's technical introduction distinguishes missing credentials from validation results. It explains that validation checks signatures, referenced assertions and the binding between the record and the asset. Trust also depends on the validator's trust policy; a cryptographically valid signature is not automatically a trusted signer.

The same documentation states that successful validation does not prove everything depicted or asserted is true or complete. A signer can identify an application, device or organization rather than the individual creator. A missing credential, meanwhile, is not sufficient evidence of false content.

Record those outcomes literally. Missing means that this check did not provide the record sought. Invalid requires identifying the validation problem before drawing a conclusion. Trusted under a particular policy still leaves the event's factual context to be established. None of these results is a universal detector verdict.

Corroboration must add information, not just repetition

Chaudry's report emphasizes the limits of detection scores and the need to trace material rather than share it reflexively. Multiple reposts are not necessarily independent sources. Searching for an earlier appearance can reveal an older caption, but no search match cannot prove originality or authenticity.

For each additional source, note what it contributes: a dated original publication, an identified witness account or independently established context. If two articles both cite the same anonymous post, counting them as two confirmations hides their common dependency.

Keep an uncertainty record instead of a pass score

A practical review note has five fields: the exact claim, the file or URL inspected, the provenance result, the independent contextual evidence and the unresolved questions. This is a proposed organizational aid, not an experimentally validated scoring system.

Do not require an arbitrary two positive checks or a sixty-second deadline to declare content ready to share. Where the evidence cannot support a claim, withhold the claim or describe the uncertainty accurately. This guide does not assess any named detector's current accuracy, promise access to satellite imagery or advise uploading sensitive material to a particular service.