How the analysis works

A screenshot is not a photograph, and the forensics are different. There is no EXIF, no camera sensor noise to fingerprint, and the file is usually a PNG or a re-compressed JPEG. Half the signals that work on a photo do not apply at all. What is left turns out to be enough, because a screenshot has one property a photograph does not: an almost perfectly uniform compression history.

Error Level Analysis (ELA) detects regions where different compression levels exist side-by-side, the signature of copy-pasted or edited content. When someone edits a JPEG screenshot and re-saves it, the edited region has been compressed twice while the surrounding interface elements have been compressed once. ELA visualizes this difference as a brightness map: tampered regions glow brighter than untouched background.

Clone detection identifies duplicated pixel regions used to hide or fabricate text. A common technique is to copy a legitimate amount from one part of a bank statement and paste it over a different figure - clone detection flags these duplicated patches.

AI-generation fingerprints catch screenshots that were never real at all - entirely synthesized by tools like ChatGPT Canvas, image generators, or dedicated fake screenshot apps. These leave GAN artifacts that are distinct from edited real screenshots.

Frequency domain analysis reveals manipulation artifacts in the DCT coefficients that compression introduces when content is modified and re-saved. UI text has characteristic high-frequency components that are disrupted when characters are replaced or pixels are altered in the text layer.

Screenshot forensics is one of the most common real-world use cases for forensic image analysis, because screenshots are the primary form of digital evidence in personal disputes, online commerce, and social media conflicts.

The four situations we keep seeing

Four situations account for nearly everything we see, and each leaves a different trace.

Chat fabrication is the most common category. Messaging conversations are edited to show words someone never said, typically done by opening browser developer tools and editing the DOM text directly in the page source before taking a screenshot - a method that requires no image editing skills and takes under 30 seconds. The result is a screenshot that looks structurally authentic but contains fabricated text. FauxLens detects these through font rendering inconsistencies and compression entropy anomalies in the text regions.

Financial fabrication covers fake bank statements, payment confirmation screenshots, and trading platform screenshots used to deceive sellers, partners, or fraud investigators. These are created either through Photoshop editing of real screenshots (leaving ELA artifacts on the altered numbers) or through dedicated fake receipt generator websites that produce synthetic financial interface screenshots detectable by UI element geometry analysis.

Social media fabrication targets follower counts, post engagement numbers, DMs, and profile statistics altered to appear more credible. Typically for influencer fraud or in online disputes. Profile stats and engagement numbers that have been Photoshopped show compression inconsistencies in the digit regions.

App screenshot fraud covers fake app store reviews, fabricated customer testimonials, and invented app analytics submitted to clients or investors. Entirely AI-generated screenshots of apps that do not exist are increasingly common in this category.

Why screenshot forensics is its own problem

Bring photo-forensics habits to a screenshot and you will reach the wrong conclusion. The two file types fail in almost opposite ways.

Photos contain EXIF metadata that can be verified against known camera signatures: make, model, lens, GPS, shutter speed, ISO. Screenshots intentionally lack metadata. Metadata absence is not a signal of tampering in screenshots; it is expected. Checking for missing EXIF on a screenshot adds no forensic value.

Instead, screenshot forensics focuses on three signals that photographs rarely provide:

Compression entropy analysis: Text and UI interface elements have dramatically different compression characteristics than photographic content. A chat message background is large areas of uniform color - it compresses to near-zero entropy. Text characters are high-contrast, high-frequency content. When a screenshot has been edited, the entropy distribution across the image changes in ways that reveal tampered regions even without visible pixel artifacts.

Font rendering and sub-pixel hinting: Operating system fonts are rendered using sub-pixel hinting algorithms (ClearType on Windows, Core Text on macOS) that produce mathematically predictable sub-pixel color patterns at character boundaries. When text is manually edited (a name changed, a number altered), the sub-pixel patterns at that location are inconsistent with the surrounding text. FauxLens checks for these rendering discontinuities at the character level.

UI element geometry consistency: Interface elements like chat bubbles, buttons, input fields, timestamp labels, and status bars follow strict dimensional conventions set by the platform's UI framework. Fabricated screenshots frequently have subtle geometric violations - a chat bubble that is 2 pixels taller than the platform renders them, a timestamp font that is marginally wrong. These geometric inconsistencies are invisible to the human eye but detectable through template matching.

FauxLens runs all of these checks automatically and presents a single confidence score with a per-signal breakdown, letting you see exactly which signals fired and why.

How fake screenshots are actually made

The quickest way to learn what to look for is to know how these are actually made. Four methods, from laziest to most careful.

Browser developer tools DOM editing is the most common method and the hardest to detect visually. The forger opens a live web page (a banking portal, a messaging app in the browser, or any web-based interface), right-clicks on the text they want to change, selects "Inspect Element," and edits the text directly in the HTML source. The browser renders the change instantly and the forger screenshots it. This method requires zero image editing skill. The resulting screenshot is a genuine operating system screenshot of a real browser rendering real pixels - the only thing fake is the data the page is displaying. Forensically, these are detectable through font rendering patterns that do not perfectly match the font stack of the original platform, and through UI element geometry violations when the forger edits content that reflows layout unexpectedly.

Photoshop or GIMP editing after screenshotting is the traditional method. A real screenshot is taken, then specific text or numbers are modified in an image editor and the file is re-saved. This is the method that leaves the most reliable ELA artifacts, because the re-saved JPEG compresses the edited regions differently from the original compression pass. Photoshop editing after screenshotting is detectable at 93%+ accuracy when the edits are localized and the screenshot is JPEG.

Dedicated fake screenshot generator apps are websites or tools that generate synthetic interface screenshots. The user fills in fields (sender name, message content, timestamp, balance amount) and the tool renders a photorealistic screenshot of a fake conversation or bank statement. These are detectable by UI element geometry analysis, the rendered interfaces rarely perfectly match the exact pixel dimensions, font weights, and spacing of the real platform versions.

AI image generation of entire conversations is the newest and most sophisticated method. A generative AI model produces a synthetic image that looks like a screenshot but was never a screenshot at all. These are detectable by GAN fingerprint analysis and frequency domain anomalies that real screenshots do not exhibit.

When a faked screenshot cost real money

Screenshot fraud is not a theoretical problem. It is an active method of deception across commerce, finance, and legal proceedings, with documented losses in the billions.

Altered agreement terms and admissions in legal disputes: Edited text message conversations are submitted in civil cases to show that a party agreed to terms, made admissions, or communicated things they never said. In family law proceedings, altered WhatsApp and iMessage screenshots are among the most commonly submitted fabricated digital evidence. Courts in the US and UK have encountered this with increasing frequency since 2022, prompting some jurisdictions to require metadata verification for digital communication evidence.

Fake payment confirmation fraud in online marketplaces: Sellers on Facebook Marketplace, eBay, and Craigslist are defrauded daily by buyers who send edited screenshots of payment confirmations: showing a Venmo, PayPal, or Zelle transfer that never occurred. The seller releases the goods before verifying the payment directly in their account. The FBI IC3 reports this as one of the top five online fraud categories by volume.

Business email compromise (BEC) using fake bank transfer screenshots: The FBI reports $2.9 billion in BEC losses in 2023. A common variant involves fake wire transfer confirmation screenshots sent to accounts payable teams to "confirm" that funds have moved - delaying discovery of the fraud. These screenshots are typically created through Photoshop editing of real bank transfer confirmations, leaving ELA artifacts on the altered routing numbers and amounts.

Fake customer service chat screenshots in insurance claims: Claimants submit fabricated chat screenshots purportedly showing that an insurer's customer service agent authorized a specific coverage or promised a specific payout. These are used to dispute claim denials.

Social media post attribution fraud: Screenshots of posts allegedly made by political figures, celebrities, or executives are edited to show statements never made, then circulated as "evidence" of misconduct. These are the most socially damaging category of screenshot fraud because the attribution of false statements to real people causes immediate reputational harm before the fabrication is identified.