Verify the claim, the file and the source before you publish

What does the Verify desk cover?

This desk covers how to check a claim, an image, a video or a document before you publish it. It also lists free tools for open-source research by task. Bellingcat calls them “open source research tools.”

The desk does not give legal advice, set newsroom policy or replace forensic analysis. Ask your editor, your counsel or a qualified specialist when the stakes call for one. Use Find Experts and Sources to locate specialists.

Tools that sell a service carry a (Commercial) label. The Editorial Standards say to “include commercial tools only when their newsroom use is clear and limitations are disclosed.”

Start here

What are the five checks before you publish?

Run five checks on any tip, post, image or document that arrives without context: preserve, identify, locate, corroborate, disclose.

Steve Buttry writes in the Verification Handbook that “The question at the heart of verification is: ‘How do you know that?’” (Verification Handbook, chapter 2) Ask it of every source, including yourself.

1. Preserve. Save the post URL, the account name, the access time with time zone and a copy of the file. Archive the page as well.
2. Identify. Separate the poster from the maker. The Handbook warns that content spreads in a way that makes “the version you first see unlikely to be the original.” (chapter 5)
3. Locate. Establish place and time from landmarks, signs, weather, shadows, language and official records.
4. Corroborate. Find an independent primary source. A repost is not a second source. The Handbook says “one piece of evidence alone is insufficient to verify a video.” (chapter 5)
5. Disclose. Tell the audience what you verified, what remains uncertain and how you obtained the material.

These checks cover the Handbook’s four elements of provenance, source, date and location. They apply to text, images, video and documents.

How do you keep a verification log?

Keep one record for each claim, image or document. Copy the fields below into your desk notes. Store the evidence with the record and update the conclusion when new facts arrive. A completed log documents your checks. It does not make an unsupported claim true.

Worked example: a bridge-closure claim

Fictional training example. A repost says Riverside Footbridge “closed this morning.” The photo has no capture date.

• Preserve. Save the post URL, the account name and the access time with time zone. Archive the page.
• Identify. The reposting account may not be the photographer. Search for earlier copies of the photo.
• Corroborate. A town notice says repairs start this week. It supports the schedule. It does not confirm a closure today.
• Log the lead. Record the search tool, the date you ran it and what it returned.
• Decide. Hold the closure claim. Ask the responsible office for the current status. Ask the poster for the original file and its capture time.

For public-records requests, use the public-records workflow. To trace copied text to its earliest source, use Plagiarism and Source Verification.

Which OSINT tools should journalists use?

Choose an OSINT tool by the question you need answered. Treat each result as a lead that needs a second source.

Bellingcat states that “Inclusion in the toolkit does not imply that Bellingcat endorses or recommends a specific tool for investigative use.” (Bellingcat toolkit) The same limit applies to this list. Tool pages change fast, so open each tool and confirm it still does what this page says.

Directories and method

• Bellingcat’s Online Investigation Toolkit: Tool reviews grouped by task. Start with its category pages.
• OSINT Framework: A directory of free OSINT resources sorted by data type. Its creator wrote, “I originally created this framework with an information security point of view.” Judge each link for newsroom use.

Claims and federal records

• Google Fact Check Explorer: Search published fact checks. A fact check is a lead to the evidence, not the evidence.
• GovInfo: The U.S. Government Publishing Office’s site for official federal publications.
• Federal Register: The unofficial daily edition of federal rules, proposed rules and notices. Check legal text against the official edition on GovInfo.

Archives and preservation

Craig Silverman writes in the Verification Handbook, “A best practice is to use the Wayback Machine to save important pages on your target website as part of your workflow.” (chapter 8) Pages can change “especially after you start contacting people and asking questions.” Archive first and contact second.

• Wayback Machine: Its home page offers to “capture a web page as it appears now for use as a trusted citation in the future.”
• Perma.cc: Creates permanent records of web sources you cite. It is built and supported by libraries.
• Auto Archiver: A Bellingcat open-source Python tool that archives web content, including social media posts and videos. It needs command-line setup.
• Hunchly (Commercial): A paid tool that saves pages automatically as you research. The Handbook calls it “a great paid tool for creating your own personal archive of webpages automatically while you work.”

Geolocation and satellite imagery

Match each imagery date to the date you need. Coverage and detail vary by place.

• Google Earth: Use Historical imagery to see how a place changed over time. Google notes that “Global coverage varies.”
• NASA Worldview: Daily satellite images of the planet as it looks today and as it has in the past.
• USGS EarthExplorer: Search satellite images and aerial photographs from the U.S. Geological Survey. You must log in to download and order scenes.
• OpenStreetMap and Overpass turbo: An open map and a query tool that shows results on an interactive map. Use them to find mapped features near a claimed location.
• SunCalc: Shows the sun’s path and shadow length for a chosen day and place. Test a claimed time of day against the shadows in a photo.

Social accounts

Archive a profile before you contact its owner. Brandy Zadrozny writes in the Handbook, “Groups of people revel in tricking journalists.” (chapter 1) Fake accounts appear fast in breaking news.

• Bellingcat toolkit, Social Media category: Platform-by-platform tool reviews.
• Reverse Directories and Source Lookup and White Pages and Public Source Lookup: Identity lookups. The Editorial Standards warn that “Directory matches do not establish identity, and publication requires a separate public-interest judgment.”

Domains and websites

• ICANN Lookup: Current registration data for domain names. ICANN says results “come directly from registry operators and/or registrars in real-time.” Privacy-protected records still show when a domain was registered, according to the Handbook (chapter 8).
• urlscan.io (Commercial): Bellingcat’s safety list describes it as a sandbox that lets you “scan a URL to check it’s safe before properly visiting it.” (Bellingcat, Stay Safe) Check the service’s terms before you submit a sensitive URL.

Flight and ship tracking

Use these only when a story turns on a plane or a vessel. Cross-check more than one source.

• FAA Aircraft Inquiry: The Federal Aviation Administration’s Aircraft Inquiry page on its registry site.
• Flightradar24 (Commercial): Live flight tracking. Bellingcat notes that “Flightradar24 honors take-down requests from operators or owners.” (Bellingcat review) Absence from the map does not show an aircraft was not flying.
• MarineTraffic (Commercial): Vessel tracking from AIS signals. Bellingcat warns that “AIS transponders can be, and are, switched off by vessels which want to avoid tracking.” (Bellingcat review)

Across these groups the rule holds. Pick the Bellingcat toolkit or another directory to find a tool, preserve what you find with the Wayback Machine or a saved copy, and confirm place and time with Google Earth, NASA Worldview or SunCalc. Check people and domains with identity-safe lookups such as ICANN Lookup. Then log each result as a lead until an independent source confirms it.

How do you verify an image or video?

Search for earlier copies first, then read the file, then check the scene, then ask the maker.

1. Find the earliest copy. Search the image with Google’s image search, which accepts an upload, a drag-and-drop or a URL. Also try TinEye (Commercial), which says it can “find the first occurrence of your image online and sort the results by the largest or most edited version.” The Handbook adds that the largest version “should take you to the original source.” (chapter 4)
2. Search keyframes for video. The InVID plugin fragments a video into keyframes you can search. Extract several distinct frames and search each one.
3. Read the file. ExifTool and Forensically can show metadata. The Handbook warns that social platforms “strip out most of the original metadata from images when they are uploaded.” It also warns that a timestamp may carry a factory setting or another time zone. Metadata that is present is a clue, and metadata that is missing proves nothing.
4. Check the scene. Compare landmarks, signs, shadows and weather against the geolocation tools above.
5. Ask the maker. Contact the apparent creator and ask for the original file and for other frames shot at the same moment.
6. Clear rights separately. Verifying authenticity does not clear permission to publish. The Handbook says to “clarify how the photographer wishes to be credited.”

For viral clips, use Trending Video Discovery and Verification, the site’s video verification desk.

What can Content Credentials tell you about an image?

Content Credentials record where a file came from and what was done to it. They do not tell you whether the content is true.

The Coalition for Content Provenance and Authenticity (C2PA) describes its standard as “an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content.” (C2PA) You can inspect a file with Content Credentials Verify. Forensically also lists a C2PA tool.

The C2PA explainer sets clear limits (C2PA explainer):

• “Provenance information alone cannot tell you whether the digital content is true, accurate or factual.”
• Credentials can be removed from a file. The explainer answers “Yes it can.”
• Provenance is not always complete. A crop in a tool that ignores credentials may go unrecorded.
• A file without credentials is not automatically suspect. The explainer says no assumption should be made about trustworthiness “purely based on its usage of Content Credentials.”

Read the signer, then judge the signer. Content Credentials from a known newsroom tell you the file came from that newsroom. They say nothing about whether the newsroom was right.

Can you detect AI-generated images and deepfakes?

No tool can settle it alone. Automated detectors give leads, and they fail in ways you cannot see from the score.

Myth: A detector can tell you whether an image or clip is real.

Why it persists: Vendors advertise automated solutions, and a detector returns a percentage that looks like an answer.

Correction: The Tow Center for Digital Journalism at Columbia reviewed recent research and concluded that “deepfake detection tools cannot be trusted to reliably catch AI-generated or -manipulated content.” (Columbia Journalism Review)

The evidence points the same way across studies:

• A benchmark of in-the-wild deepfakes circulated in 2024 found that open-source detection models lost much of their accuracy. AUC fell 50% for video models, 48% for audio models and 45% for image models compared with earlier benchmarks. The benchmark holds 45 hours of video, 56.5 hours of audio and 1,975 images. (Deepfake-Eval-2024, arXiv)
• The same paper found that commercial and fine-tuned models did better than open-source ones but “do not yet reach the accuracy of deepfake forensic analysts.”
• WITNESS researchers found that “most of the results provided by AI detection tools give either a confidence interval or probabilistic determination (e.g., 85% human), whereas others only give a binary ‘yes/no’ result.” (Columbia Journalism Review) WITNESS also lists false positives, language challenges and variable accuracy among common issues in its tipsheet on AI detection tools.
• A 2024 University of Mississippi experiment found that journalists with detection tools sometimes overrelied on them, according to the same Columbia Journalism Review report.

Visual tells fail too. Sam Gregory of WITNESS calls checking for glitches “the least robust approach to identifying deepfakes and other synthetic media modifications.” He also recounts that within weeks of a 2018 paper on blinking, the researcher received videos of a deepfake persona blinking like a human. (Verification Handbook, chapter 6) That chapter was written in late 2019, so use it for its reasoning and not for its list of tools.

What to do:

• Log any detector result as a lead with the tool name and the date.
• Never publish “fake” or “real” on a score alone.
• Run the image and video checks above and ask the person depicted.
• Remember Gregory’s caution that “the absence of evidence that something was tampered with will not be conclusive proof that media has not been tampered with.”
• Verify authentic material too. Gregory notes that falsely calling real content a deepfake is increasingly common.

How do you attribute verified and unverified material?

Attribute every disputable fact to its original source. Label what you could not verify.

The Associated Press says “Anything in the AP news report that could reasonably be disputed should be attributed.” It adds that “Information taken from the internet must be vetted according to our standards of accuracy and attributed to the original source.” (AP News Values and Principles) NPR’s Ethics Handbook says, “We attribute information we receive from others, making perfectly clear to our audience what information comes from which source.” (NPR Ethics Handbook)

AP also requires that “File, library or archive photos, audio or videos must be identified as such.” It does not allow vague sourcing: “simply quoting ‘a source’ is not allowed” when material is anonymous.

Use these patterns as a starting point. The example wording is fictional.

The Handbook’s advice on doubt applies to all of them: if you are “still in doubt – don’t use the image!” (chapter 4)

For this site’s own rules on link selection, review dates and corrections, read the Editorial Standards. They say to “treat automated results as leads that require editorial checking.”

Reporting checks

• Did you save the original URL, the account name, the access time with time zone and a copy?
• Did you separate the poster from the maker?
• Did you find the earliest copy of the image or video?
• Did you confirm place and time with a source other than the poster?
• Did you log every tool result as a lead and name the tool and the date?
• Did you attribute each disputable fact to its original source?
• Did you tell the audience what remains unverified?
• Did you apply a public-interest test before you published any personal details?

What changed on October 30, 2026: rebuilt the desk with a five-check workflow, a verification log, OSINT tools grouped by task, image and video checks, Content Credentials limits, deepfake detection limits and attribution patterns. The worked example and the related guide links stay.

Next step: Find Experts and Sources

Sources

1. Verification Handbook verificationhandbook.com
2. Verification Handbook 1, chapters 2, 3, 4 and 5 datajournalism.com
3. Verification Handbook 3, chapters 1, 6 and 8 datajournalism.com
4. Bellingcat’s Online Investigation Toolkit bellingcat.gitbook.io
5. Bellingcat toolkit reviews of Flightradar24 and MarineTraffic, Social Media category and Stay Safe bellingcat.gitbook.io
6. Columbia Journalism Review, Tow Center, What journalists should know about deepfake detection in 2025 cjr.org
7. Deepfake-Eval-2024, Chandra and others arxiv.org
8. WITNESS Library, Things to know before using AI detection tools library.witness.org
9. C2PA c2pa.org
10. C2PA and Content Credentials Explainer spec.c2pa.org
11. Content Credentials Verify verify.contentauthenticity.org
12. The Associated Press, News Values and Principles ap.org
13. NPR Ethics Handbook npr.org
14. Google Fact Check Explorer toolbox.google.com
15. GovInfo govinfo.gov
16. Federal Register federalregister.gov
17. Wayback Machine web.archive.org
18. Perma.cc perma.cc
19. Auto Archiver github.com
20. Hunchly hunch.ly (Commercial)
21. OSINT Framework osintframework.com
22. Google Earth historical imagery developers.google.com
23. NASA Worldview worldview.earthdata.nasa.gov
24. USGS EarthExplorer earthexplorer.usgs.gov
25. OpenStreetMap and Overpass turbo openstreetmap.org, overpass-turbo.eu
26. SunCalc suncalc.org
27. ICANN Lookup lookup.icann.org
28. urlscan.io urlscan.io (Commercial)
29. FAA Aircraft Inquiry registry.faa.gov
30. Flightradar24 flightradar24.com (Commercial)
31. MarineTraffic marinetraffic.com (Commercial)
32. Google Search Help, Search with an image on Google support.google.com
33. TinEye tineye.com (Commercial)
34. InVID Verification Plugin invid-project.eu
35. ExifTool exiftool.org
36. Forensically 29a.ch
37. AssignmentEditor.com Editorial Standards assignmenteditor.com