How to spot a fake screenshot

A fake screenshot almost never fails on the thing people look at first. The bubble colours are usually right, the font is usually right, the layout is usually close enough. What gives it away is consistency: a detail that contradicts another detail, because a real interface derives them from the same state and a forger sets them by hand.

These checks are ordered by how often they work, not by how clever they are.

1. Read the receipts against the clock

This is the single most productive check. Every messaging app has a strict progression — sending, sent, delivered, read — and it only moves forward. A message showing Read above a later message showing Delivered is impossible in a real thread, because reading a conversation marks everything before it.

Platform specifics matter here, and forgers routinely get them wrong:

• Telegram has no “delivered” state at all. One tick means it reached the server, two ticks means it was read. A Telegram screenshot showing two grey ticks and a separate “Read” label is showing something the app cannot draw.
• SMS has no read receipts. A green iMessage bubble with a “Read” caption underneath is a contradiction: green means it went as SMS, and SMS cannot report back.
• WhatsApp’s blue ticks are all-or-nothing per person. If the recipient has read receipts off, nothing in the thread turns blue — not some of it.

2. Check the status bar against the conversation

The clock at the top of the phone is part of the same screenshot as the timestamps in the thread, and forgers edit them separately. A conversation whose last message is 4:12 PM sitting under a status bar reading 9:41 AM is the most common single error in fake screenshots — partly because 9:41 is Apple’s default in every marketing image, so it appears far more often than chance would allow.

Check the battery too. A long conversation spanning hours, captured at 100% battery, is possible but worth noticing.

3. Look at how the text wraps

A real message wraps according to the bubble’s maximum width, which is a fixed fraction of screen width. Every bubble in a real thread that reaches that limit breaks at exactly the same right-hand edge. Edited text often wraps a few pixels short or long, because it was typed into an image rather than laid out by the app.

Related: real threads have ragged line lengths. Text that breaks suspiciously neatly, with no short final line anywhere, has usually been composed to fit.

4. Compare the fonts across the whole image

Editing existing text in a screenshot means matching the system font, its weight, its size and its letter spacing. It is the hardest thing to do convincingly and the easiest to check: zoom in and compare the suspect text with text elsewhere in the same image that nobody had a reason to change — the contact name, the status bar, the composer placeholder.

Look for slightly different anti-aliasing, a hair more or less spacing between letters, or a subtly different grey. Screenshots are lossy; re-rendered text often is not, so the edited region can look cleaner than its surroundings.

5. Test the platform’s own conventions

Each app does specific things that a generic mockup misses. A few that catch fakes regularly:

• Discord has no bubbles. Messages are flat rows on the background, your own look identical to everyone else’s, and consecutive messages from one person group under a single avatar. A bubbled, left-and-right-aligned Discord screenshot is wrong at a glance.
• Facebook shows overlapping reaction circles with a total beside them, not a plain like count, and its post text sits above the photo. Instagram puts the caption below.
• X puts a view count on the post detail view, on its own line with the timestamp. No other platform does.
• Group chats label the sender, not the group. Every incoming bubble carrying the group’s own name is a mistake generic tools make constantly.

6. Check the dimensions against a real device

A genuine screenshot has the exact pixel dimensions of the device that took it, and that is a short, well-known list. An image at 1206×2622 came from an iPhone 16 Pro. An image at 1187×2640 came from nothing — it has been cropped, resized, or generated.

Cropping is legitimate and common, so an odd size is not proof of anything by itself. It does mean the image is not what came off the phone, which is worth knowing before you rely on it.

7. Look for what is missing

Forgers add; they rarely remember to add the boring things. Real threads contain date dividers, “this message was deleted” tombstones, encryption notices, an unread divider, and the occasional system notice about someone changing the group name. A thread that is nothing but clean, relevant, quotable messages is a thread that was written rather than captured.

8. Ask what the screenshot conveniently proves

This is not a technical check and it is the most reliable one. Fake screenshots are made for a reason, and the reason is usually visible in the frame: a confession, an admission, a slur, a price. Real conversations meander and contain irrelevance. If a single image contains exactly the sentence someone needed and nothing else, treat it sceptically regardless of how good it looks.

9. Ask for the conversation, not the picture

When it matters, stop analysing the image. Ask the person to open the thread and scroll through it — live, in the app, past the message in question and beyond. Faking a still is easy; faking a scrolling interaction on demand is not. If they cannot or will not, that is information.

For anything with legal or professional weight, the only thing that carries any is the platform’s own data export, which is available on request from every major service and is what an investigator will ask for anyway.

Why we are the ones telling you this

SocialMock makes fake chat screenshots. That is the product. It exists for storyboards, product mockups, teaching material and jokes, and our acceptable use policy prohibits using it to impersonate anyone or to pass an image off as genuine.

Publishing this is not a contradiction of that. A tool like this should make people harder to fool, not easier to fool — and everything above is knowledge we had to acquire anyway to build interfaces that look right. If it helps you disbelieve a screenshot that deserves disbelieving, that is the correct outcome.