How to prove a photo is real in the AI era

The proof problem got worse this year

Insurers noticed first, because they pay for it. A 2026 Verisk study found that 99% of insurers say they have already encountered manipulated or AI-altered documentation, and 98% agree AI editing tools are driving a rise in digital fraud (SAS / Verisk, 2026). The examples are mundane, which is what makes them dangerous: a real photo of an intact van with a cracked bumper painted in by AI, then submitted for thousands in repairs; a coffee stain generated onto a chair and presented as tenant damage (Debevoise & Plimpton). None of it took skill. Fabricating a believable photo used to need an expert and an afternoon. Now it needs a prompt.

For anyone who relies on a photo as a record — a completed repair, a delivered load, a finished cleaning, a caregiver visit — that is the whole game. If a photo can be faked in seconds, “here is a photo” is not proof anymore. It is a claim, and claims are what get disputed.

Looking at the image is not a test

The instinct is to look harder — count the fingers, check the shadows, zoom into the reflections. That worked on the clumsy fakes of a couple of years ago. It does not work now. The current generation of image models produces photos that pass a careful human look, and the tells people share online are outdated by the time they spread. Treating “it looks real” as evidence is exactly how the fabricated van claim gets paid.

An AI detector gives you a probability, not proof

The next instinct is to run the image through an AI-detection tool. Those tools return a score — “95% likely real” — and a score is not evidence. Two things make it worse. First, detectors disagree: the same image can come back 95% real from one and 60% AI from another, and you have no way to settle which is right (Snopes). Second, they degrade fast — every new image model is trained against the last detector. A number that changes depending on which tool you ask, and gets weaker every month, is not something to stake a disputed invoice on.

The metadata inside a photo can be rewritten

Then people reach for the EXIF data — the camera model, the GPS, the timestamp baked into the file. It feels authoritative. It is trivially editable. Every one of those fields can be changed in seconds with free tools, and a photo’s embedded timestamp can be set to any date you like. Metadata that the person submitting the photo can rewrite is not a record of anything. It is one more thing to fake.

What holds up is provenance, captured at the moment

Notice the pattern in what fails: every one of them tries to judge the photo afterit already exists. By then it is too late — the fake is baked in. The only approach that holds up flips the order. You establish where the photo came from at the moment it is taken, in a way the person holding the phone cannot control, and you seal that record so it cannot be edited afterward. That is provenance, and it is the one signal the experts converge on.

For consumer photos, the emerging standard is C2PA content credentials — a tamper-evident record of an image’s origin and edit history, backed by Adobe, Microsoft, Sony, Nikon, and the BBC. Think of it as a nutrition label for a photo: not a judgment of whether the content is good, just a verifiable record of where it came from and whether it was altered. For field work — a job, a visit, a delivery — the same principle takes a more direct form.

How this works for a work photo

LockProof is built on that flip. A worker gets a text link, and the link opens a live camera — the gallery is blocked, so a worker cannot just attach an old photo, a stock image, or an AI-generated file. The photo has to be taken live, through the link, right then. That closes the most common shortcut — uploading a picture you did not just take. It does not make fakery impossible; someone determined could still photograph a screen. What it does is force the photo to be captured rather than chosen, which shuts the easy door.

Then the record is sealed. At capture, the photo is stamped with a server-set time the worker cannot change, its GPS location, and a SHA-256 fingerprint over the image, the location, and the time — a chain of custody. If anyone edits the record afterward, the fingerprint no longer matches, so the change is detectable. Be precise about what that proves: it proves the record has not been altered since it was captured, and that the photo came in live through the link at that place and time. It does not certify that the scene itself is truthful — no capture can. What you get is narrower and honest: provenance and integrity — where a photo came from, and that it has not been touched since.

Every way to check a photo, and whether it is proof

None of this makes a photo automatically admissible in court — that is a judge’s call, and no software can promise it. What it does is narrower and honest: it makes each photo a dispute-ready record with a clear chain of custody, so when a client or a payer questions the work, you are not arguing “it looks real.” You are showing where the photo came from and that it has not been touched. See what that looks like in a sample verified record, or how field teams put it to work in field service.