Ask for the original: how forwarding, screenshots and scans erase evidence

Most images that reach a compliance reviewer are not originals. A receipt photo is taken on a phone, sent to a colleague in a chat app, screenshotted, pasted into an email, attached to an expense claim and exported again by the expense system. Each step looks harmless. Each step also throws away some of the detail that image analysis depends on, and none of them can be undone.

The single most effective thing a reviewer can do to improve any detection result is to analyze a better file. This guide explains what each kind of copy loses and how to ask for the original in a way that gets it.

What each copy throws away

Messaging apps

Most messaging apps recompress photos by default to save bandwidth. They typically shrink the image, save it again as a JPEG at a lower quality, and strip the camera metadata, including the capture time, the device model and the location. The picture still looks fine on a phone screen. The fine texture between and around the characters, which is where traces of generation and editing live, is gone. Many apps offer an option to send the original or full-quality image, or to send the photo as a file or document; both keep the file intact.

Email

An image sent as an attachment usually arrives byte for byte as it was sent. Two common exceptions: some mail apps offer to shrink photo attachments before sending, and images pasted into the body of a message rather than attached may be converted along the way. If the file you received is much smaller than a phone photo normally is (often 2 to 6 MB for a full-resolution shot), it was probably resized somewhere.

Screenshots

A screenshot is not a copy of the image. It is a new image of whatever the screen showed, at the screen's resolution, after the viewer app scaled it to fit. Every pixel is recalculated, the JPEG saving history of the original is discarded, and all metadata is replaced with the screenshot's own. If a receipt was manipulated, a screenshot of it is one of the most effective ways to hide that, whether or not anyone intended it.

Scans, photocopies and photos of printouts

Printing an image and capturing it again replaces its digital history with the texture of paper, toner and the scanner or camera. Edits that were obvious in the file can become invisible, and scanning artifacts can look like edits. A scan is the right evidence for a document that only ever existed on paper. For anything that started as a digital file or a phone photo, it is a poor substitute.

PDFs and format conversions

Software that builds a PDF often recompresses the images inside it, and turning a PDF page back into an image adds another rendering step. Converting a phone photo from a high-efficiency format to JPEG saves it again. Each conversion is one more generation away from the original. If you have to convert, export at the highest quality the tool offers and do it once.

What that does to each check

The three checks in VeriSight degrade in different ways, which is useful to know when you read a report on a copy:

• The AI check loses signal. Results on screenshots, heavily downscaled images and forwarded copies are less reliable, mostly in the direction of scoring too low.
• The tamper check can miss edits whose traces were smoothed over by recompression, and it can flag regions where heavy recompression or scanning left artifacts of its own.
• The error level view in the visual review flattens. When a file has been saved many times, almost every pixel stops changing when it is saved again, and the view mostly shows edge contrast. The report says so in its note on the view, for example that error levels are near zero across the whole image or that no JPEG block grid is detectable. Treat either note as a sign that you are working from a weak copy.
• The ink channel views hold up best, because they depend on color, which survives recompression better than fine texture does. They still blur at low resolution, so small text becomes hard to compare.

How to ask for the original

Most people who send a screenshot are not hiding anything. They sent what was convenient. A specific request, with the reason, usually gets the original the same day.

From an employee

Ask for:

• The photo straight from the phone's photo library, sent as an email attachment or uploaded as a file, not through a chat app and not as a screenshot.
• No cropping, rotating, filters or markup before sending.
• The photos taken just before and after it, if there are any. A genuine receipt photo usually sits among other photos from the same trip; a fabricated one often stands alone.
• For a merchant that emails receipts, the original email rather than a picture of it.

From a vendor or venue

• The invoice as issued by their billing system, usually a PDF, not a scan of a printout.
• Where your market has an official invoice verification service, the invoice number and verification code so you can check it yourself.
• For events, the itemized bill with the number of covers, and the booking confirmation.

When you can only get a copy

Sometimes the original is genuinely gone: the phone was replaced, the chat was deleted, the vendor closed. Analyze the best copy you have, and be explicit about its limits.

• Keep what you received exactly as it arrived. Save the file without opening and re-saving it in an editor, note when and how you received it and from whom, and if your process allows, record a SHA-256 hash of the file so you can show later that it did not change.
• Analyze the largest version you have. If a file is above the upload limit, VeriSight offers to compress it and retry. That re-encodes the image on your device: it keeps as much detail as it can, but it is one more save. The report notes that the file was re-encoded; mention it in your case note too.
• Describe the provenance in the finding. “The analyzed image is a screenshot forwarded through a messaging app; the original was not available” tells the reader how much weight the results can bear.
• Lean harder on independent records. The card transaction, the venue's booking, the itinerary. None of them degrade when an image is forwarded.

Next in this series: how to spot typed-over fields in the visual review, which is where a good original pays off most.