You have seen something online and you are not sure it is real. A photo of a disaster. A video of a politician saying something startling. A message from your bank. A voice on the phone that sounds like your daughter.
The old advice was to look closely. Count the fingers, check the teeth, look for warped text in the background. That advice is going out of date fast, and following it now can leave you more confident and less safe.
The checks below do not ask you to spot the fake. They ask you to check where it came from, which works whether or not the fake is any good.
What are you trying to check?
Most fake images fail the source test long before they fail the eye test.
Search the image, not the story
Save the image, then upload it to Google Lens or TinEye. If it is real and newsworthy, it usually turns up elsewhere, often older and in a different context.
Check who posted it
Open the account. How old is it? What else has it posted? Pages built to spread fakes are often weeks old with no real history.
Look for the claim somewhere you already trust
A genuine major event in Aotearoa gets covered by RNZ, Stuff, or the Herald within hours. If only one unfamiliar page has it, that is the story.
Do not rely on spotting flaws
Extra fingers and warped text are disappearing fast. Finding no glitches does not mean an image is real, so do not treat that as the deciding test.
Voice and video are now cheap to fake. The reliable check is the channel, not the content.
Treat urgency about money as the alarm
Nearly every harmful deepfake ends with a request for money, access, or personal details, usually in a hurry. That combination matters more than how convincing it looks.
Verify on a channel you chose yourself
Hang up and call back on a number you already had. Never use a number or link supplied in the message itself.
Agree a family safe word
A word only your family knows defeats a cloned voice instantly. Pick one now, before you need it.
Check what public figures actually said
If a politician or executive appears to say something remarkable, it will be on their official channels and in mainstream coverage. If it is not, it did not happen.
Be extra wary of short, low-quality clips
Compression, cropping, and shaky footage hide the seams. A grainy fifteen second clip is easier to fake than a clean two minute one.
AI has removed the old tells. Bad grammar is no longer a reliable warning sign.
Never use the link or number in the message
Go to the organisation yourself. Type the address you already know, or use the number on the back of your card.
Urgency is the tell
Your account will close, your parcel is held, your payment failed, act now. Real organisations do not work like this.
Read the sender address in full
Tap or hover to see the whole address, not just the display name. Look for small substitutions in the domain.
Ask why they need it that way
No bank, agency, or company will ask for a password, a code you were sent, or payment in gift cards.
Forward scam texts to 7726
It is free, and it helps the Department of Internal Affairs shut the sender down.
This is where New Zealanders have lost the most money, and where deepfakes are used most often.
Assume celebrity endorsements are fake
Deepfakes of well known New Zealanders have already been used to sell fake investments here. Public figures do not promote get-rich schemes in social ads.
Check the FMA warning list
The Financial Markets Authority publishes a list of businesses to be wary of. Search the company name there before anything else.
Guaranteed returns do not exist
Any promise of a fixed, high, risk-free return is either a lie or unlicensed. Both are reasons to walk away.
Search the name plus the word scam
Someone has often been caught already and written about it.
Slow down
Pressure to decide today is a sales tactic, not an opportunity. A real investment will still be there next week.
The one habit that covers most of it
If you remember nothing else, remember this: verify on a channel you chose yourself.
Do not click the link in the message. Do not ring the number in the email. Do not reply to the account that contacted you. Close it, and go to the organisation the way you normally would. Type the address you already know. Use the number on the back of your card. Ring your family member on the number already in your phone.
A convincing fake can control what it shows you. It cannot control what happens when you go and check somewhere else.
Why spotting the fake no longer works
The visual glitches everyone learned to look for are the easiest problems to fix, and they are being fixed. Hands are largely solved. Text in images is improving. Voice cloning now needs only a few seconds of audio, which most people have posted publicly without thinking about it.
This matters more than it sounds. If your confidence rests on being able to see the flaws, then the better the fakes get, the more confident and the more wrong you become. Checking the source does not have that problem.
This has already happened here
A pensioner in Taranaki lost $224,000 after seeing a deepfake video of the Prime Minister promoting a cryptocurrency investment. A deepfake of a former Health Minister was used to sell a blood pressure treatment she had never heard of. An AI-generated image of a bank chief executive ran in scam ads on Facebook for long enough that the bank complained four times.
None of these were aimed at people who are careless. They were aimed at people who trusted a familiar face. You can see the full record in our AI Incident Tracker.
Where to report it
- Online scams and harm: Netsafe, 0508 638 723.
- Money lost, or a crime: Police on 105. Call 111 if someone is in immediate danger.
- Investment and financial scams: the Financial Markets Authority.
- Scam texts: forward them to 7726. It is free.
- Your bank, if money has moved: ring them straight away on the number on your card.
If you have been caught by one of these, you are in very large company and none of it reflects on you. Reporting it quickly is what gives you the best chance of recovery, and it helps the next person too.