How to Detect a Deepfake Video: What Actually Works in 2026

The early advice worked because early face-swap pipelines had specific, repeatable weaknesses. Training corpora were built from web images of people with their eyes open, so generated faces under-blinked. Blending was crude, so hairlines and jawlines showed seams. Temporal consistency was an afterthought, so faces flickered.

Every one of those was a solved problem within about two years of being published. That is the nature of an adversarial field: naming a weakness publicly is also a specification for fixing it. Advice that tells an investigator to look for artefacts that current tooling no longer produces is worse than no advice, because it produces false confidence in a clean result.

The deeper issue is that visual inspection asks the wrong question. It asks whether the image looks wrong to a human. Modern synthesis is optimised precisely against that objective — human perceptual plausibility is the loss function. You are inspecting for the one property the system was trained to get right.

The methods that hold up share a property: they measure something the generator has to fabricate rather than something it copies. Four families are worth understanding.

Every method above has conditions under which it fails, and those conditions are common. Physiological measurement degrades with subject motion, poor lighting and heavy compression. Frequency analysis degrades when a file has been re-encoded — which describes essentially everything that has passed through a messaging platform. Provenance is absent from most media in circulation.

A single detector gives you one number with no way to know whether it landed in the regime where that method works. Multiple independent families let you see whether they agree, and disagreement is information: it usually means the exhibit is degraded, unusual, or genuinely borderline.

There is a subtlety here that catches most systems. Related measurements must not be counted as independent corroboration. Six measurements that all fire on the same recompression are one piece of evidence, not six, and averaging them manufactures confidence the underlying physics does not support.

This is the single most consequential error in the field, and it is almost universal in commercial tooling.

Most detectors can only evidence manipulation. A blending-boundary test that finds nothing has established that there is no composite — which is exactly what a wholly generated video looks like, because nothing was composited. Treating that silence as evidence of authenticity is how a fully synthetic exhibit gets scored "authentic" with high confidence.

The correct handling is asymmetric. Detectors of this kind may indicate manipulation loudly, but must never assert authenticity. A genuine finding of authenticity requires positive evidence of real capture: a recovered sensor signature, a coherent physiological signal, a valid provenance manifest.

Inconclusive is a substantive finding, not a failure. It means the available evidence does not discriminate for this exhibit — usually because the file has been compressed and redistributed until the recoverable evidence is gone.

The productive response is to stop asking the file and start asking around it. Obtain a higher-quality original from the source device rather than a forwarded copy. Issue preservation requests to the hosting platform before the upload record expires. Pursue the account, the device and the circumstantial account of how the media came to exist.

These lines of enquiry do not depend on the detection result holding up under challenge, which is precisely why they are worth more.

For an investigator handling a suspected deepfake, the order that works: