Signs a Document or Screenshot Was Photoshopped
Compression halos, mismatched fonts, misaligned digits and impossible shadows — the visual signs of an edited image, and why compression makes them easier to find.
Image editors make it easy to change a number on a screenshot or a scanned document. They don't make it easy to change it perfectly. Compression, fonts, alignment and lighting all leave traces — and most of them are visible if you know where to look.
Compression halos
JPEG images are compressed in small blocks, usually 8 × 8 pixels. When part of an image is edited and saved again, that area is compressed differently from the rest. Error level analysis (ELA) re-saves the image and highlights the difference — an edited value often shows up as a bright box against a calm background. ELA needs care: high-contrast edges and text naturally light up, so compare similar areas, not text with background.
Font and weight mismatches
Apps and documents use specific fonts with specific rendering. A retyped value in a similar font often differs in stroke weight, letter spacing, digit shapes (look at 1, 4 and 7) or anti-aliasing — the soft pixels at the edge of each letter.
Alignment and baseline
Edited digits sometimes sit a pixel higher or lower than their neighbors, or break the column alignment. Draw a straight line under a row of numbers in any image viewer: an edited digit often doesn't touch it.
Background inconsistencies
Covering old text with a patch leaves color or noise differences — subtle on a flat background, visible when you increase contrast or brightness. Paper documents add texture and lighting gradients that a flat patch doesn't reproduce.
Copy-paste clues
Identical pixels in two places — the same signature, the same stamp, the same digit rendered identically down to the noise — suggest a copy. Real scans and photos never repeat exactly.
Composite screens
Screens assembled from several screenshots can mix light and dark mode, different status bars, interface versions or even phone models.
Clock contradictions
On phone screenshots, the status-bar clock should be later than any time shown on the screen. A payment "completed at 14:31" on a screenshot taken at 14:12 didn't happen as shown.
Lighting and shadows in photos
In photos of paper documents, edited areas can lack the shadows, folds and perspective of the paper around them. Text that is perfectly flat on a curved page is a strong signal.
What these signs can't tell you
None of these signs proves fraud on its own. Screenshots get recompressed when they're shared, scanners produce artifacts, and genuine documents are sometimes edited for innocent reasons (redacting an account number, for example). Use the signs to decide what to verify, and confirm with the issuer when the decision matters.
Automation
ThisVerify combines pixel-level analysis with visual inspection and marks the exact region that looks edited — with an explanation for each finding.