Some photos and videos now carry a real, checkable record of where they came from, called Content Credentials — but most images never had one, and a photo missing one is not more suspicious than any other ordinary photo. Presence can tell you something real; absence tells you nothing at all.
This is the most important thing on this page, so it comes first instead of last: if you check a photo and find no Content Credentials attached, that tells you nothing. Not "probably fake." Not "worth a second look." Nothing.
There are two separate reasons for this, and either one alone would be enough. First, this is still a young standard — the camera that took most of the photos already on your phone, and the phone before that, and every photo anyone has ever sent you, never attached anything like this, because the technology didn't exist yet or the device doesn't support it. The overwhelming majority of real, ordinary, completely genuine photos in the world have never had Content Credentials and never will. Second, even a photo that started out with real credentials attached routinely loses them along the way — a screenshot captures only what's on the screen, not the original file's hidden data, so it never carries credentials at all regardless of what the original had. Saving an image from a text message, a social media post, or a messaging app frequently strips it too. The standard's own documentation acknowledges this directly: credentials "can be separated" from a file, whether by accident or on purpose.
Put those two things together and you get the honest picture: a missing credential describes almost every photo you will ever see, real or not. Treating its absence as a red flag doesn't make you safer — it makes you distrust ordinary, genuine photos for no real reason, which is exactly the trap the lesson on visual tells warns about from a different angle. A check that produces false confidence in one direction is just as much a problem as one that produces false suspicion in the other.
When a photo or video does carry Content Credentials, they work like a signed receipt attached to the file: what created it, what edited it, and when — checkable, not just claimed. If you open the credentials on an AI-generated image and it says so, that's a real, meaningful signal, not a guess.
The real, official tool for checking is Content Credentials Verify, run by the Content Authenticity Initiative, the group behind the standard: upload a file or paste a link, and it shows you the credential chain if one exists. It won't tell you a photo is fake if nothing turns up — for all the reasons above, that's expected, not a red flag.
Content Credentials are worth checking when they're there, and worth understanding for what they can't tell you when they're not. They're not a replacement for reverse image search, which works on any photo whether or not it ever had credentials attached, and they're not a substitute for what a message is actually asking you to do — a photo can carry a perfectly valid credential and still be attached to a scam request that has nothing to do with whether the image itself is real.