Spotting typed-over fields: a field guide to the visual review

The most common manipulation on receipts, invoices and badges is not AI. It is a field changed with ordinary image software: the old value covered with a patch painted to match the paper, and a new value typed on top in a similar font. It takes a few minutes, and at normal zoom it fools most people.

VeriSight's visual review computes four views of every image to make that kind of edit easier to see: the cyan and magenta ink channels, an ink color map, and error level analysis. None of them gives a score. They show you where to look, and this guide explains, step by step, what to look for in each one and what will mislead you.

How fields get changed

Knowing the technique tells you which traces to expect.

• Patch and retype. The old text is painted over with a color sampled from the paper, and new text is added with a text tool. Expect a background rectangle that differs from the paper around it, and text whose color and edges differ from the printed text.
• Copy-move. A digit or word is cloned from elsewhere on the same document, for example a “1” copied in front of the total to add a hundred. The glyphs match perfectly because they come from the same print. Expect repeated texture instead: the same speck, crease or fade appearing twice.
• AI fill. The field is selected and regenerated by an AI model. The AI check is designed for this; the views below can also show it when the regenerated area has a different texture.

Before you start

Two preparations make every step below faster and more reliable.

1. Use the best file you can get. All four views lose detail with every forward and screenshot. Ask for the original first.
2. List the fields that matter, and their peers. For each field that someone would have a reason to change (the total, the tax, the date and time, the number of covers, a name), pick the fields that were produced the same way at the same time. On a receipt, the item prices were printed by the same printer in one pass, so they are the total's peers. On a badge, the pre-printed labels form one set and the personalized fields printed later form another.

Step 1: Read the original at 200%

Start with the photo itself, zoomed in. Many edits are visible once you know what to compare.

• Glyphs. Compare the same character in the suspect field and in its peers: every 0, every 7, every decimal point. Text from one printer and one font has identical glyphs. A 7 with a different angle or a 0 of a different width is a strong cue on its own.
• Spacing. Receipt printers mostly use fixed-width fonts, where every character takes the same space. Proportional spacing in one line stands out once you look for it.
• Baseline and perspective. Printed text on a curved, creased or angled receipt follows the paper. Text added later in software sits on a straight line and ignores the perspective.
• Sharpness and grain. A field noticeably crisper or softer than its neighbors, or one without the grain the rest of the photo has.
• Light. Shadows, folds and gradients run across printed text. Typed text often sits on top of them, uniformly dark.
• Content. Do the sums. Check the tax rate, the weekday of the date, the time against opening hours.

Step 2: The cyan and magenta ink channels

What the view shows

VeriSight converts every pixel from screen colors (RGB) to print colors (CMYK) and shows the cyan and the magenta component as grayscale images. Brightness is ink amount: black means none, white means full. White paper therefore turns black, and text turns some shade of gray.

Why it works

Photographed printed text is never perfectly neutral. The ink or thermal coating, the paper, the light and the camera together give every print pass a slight color cast, and all the text from one pass shares it. Text typed in software is a flat color the editor picked. A perfectly neutral black or gray has no cyan or magenta at all; it goes entirely to the black channel, so it shows up as black in both views while the printed text around it shows up gray. A picked color with a cast of its own can instead read brighter than its peers.

That direction is not fixed. In one set of doctored badge photos, the replaced fields read about 150 in the magenta channel while the printed labels next to them read about 105. In another document the replaced field may read darker. The cue is the difference, not which way it goes.

How to read it

1. Find the suspect field and its peers, as listed before you started.
2. Compare their tone. Fields from one pass share one tone. A field markedly brighter or darker than its peers was produced differently.
3. Look at the edges. Printed text in a photo fades into the paper over a pixel or two. Typed text often has hard edges with no transition.
4. Look at the paper around the field. It should carry the same noise and gradient as the rest of the paper. A patch shows as a flat rectangle, sometimes with a visible border.
5. Check both channels. A difference in both is stronger than a difference in one.

Putting numbers on it

The views carry no numbers, but you can measure them. Save the view image from the report, open it in any image editor, and read the gray value with the color picker at the center of several strokes in the suspect field and several in a peer field. Average five or more readings for each. Differences of a few levels are noise. The badge example above had a gap of about 45 levels. Treat anything between as a reason to look harder, not as a finding.

What misleads

• The darkest pixels. As a pixel approaches pure black, its channel values swing widely, because a tiny color difference is divided by a tiny remaining brightness. Judge a field by the tone of its strokes overall, not by the darkest pixels in it.
• Fields printed differently on purpose. Names printed onto pre-printed badge stock, handwritten amounts, stamps, highlighter, colored logos and red totals all legitimately differ from the black print around them.
• Uneven light. Lamp light on one side and daylight on the other shift every tone across the image. Compare peers that sit close together.
• Copy-move. Cloned digits come from the same print pass, so they share its tone. The channels will not catch them; look for repeated texture and use the error level view.

Step 3: The ink color map

What the view shows

Every dark stroke keeps its color with the color cast amplified five times; everything lighter fades to pale gray. The paper drops away, and text that looked black becomes visibly brown, blue, green or violet, depending on its cast.

How to read it

• One hue per pass. Text written in one pass shares one cast. A total in neutral gray among item lines in warm brown is the same cue as in the channels, made easier to see at a glance.
• Color texture along the strokes. Photographed text carries color noise and fringes along its edges from the camera sensor and lens. Text added in software often has clean, even color from edge to edge, or a different pattern of fringes.
• The same misreads apply. Colored print, stamps and handwriting differ legitimately, and uneven light shifts the cast across the image.

Step 4: Error level analysis

What the view shows

VeriSight saves the image again as a JPEG at quality 95 and shows how much each pixel changed, amplified so the differences are visible. The amplification is chosen per file, between 8 and 64 times, and is stated in the report. JPEG compresses in blocks of 8 by 8 pixels, and content that has been saved the same number of times at the same quality changes by similar amounts when saved again.

How to read it

• Brighter or darker than comparable content. A field typed after the rest of the image had been through several saves has been saved fewer times, so it usually changes more and shows brighter. Compare it with text of the same size and weight.
• The rectangle around the text. Often the clearest sign is not the new text but the patch painted to hide the old one: a rectangle of paper with a different level or texture from the paper around it.
• A different block pattern. A region pasted from another image, or moved by a distance that is not a multiple of 8 pixels, carries a block grid that does not line up with the rest. Under amplification it looks like a rectangle of differently textured noise.

Read the note first

Each report says how much saving history the file still carries, and that decides how much this view can show:

• Aligned JPEG grid. The 8-pixel grid starts at the image origin. The file still carries its saving history; this is the best case.
• Offset JPEG grid. The image was cropped or padded after it was compressed. The error floor is higher everywhere, so only strong differences mean anything.
• No JPEG grid. The image was resampled, is a screenshot or export, or was saved at a very high quality. Levels then follow edge contrast and texture more than history.
• Error levels near zero across the whole image. The file was already saved at or below quality 95, often many times, or carries little fine detail. The bright areas in the view then mark contrast, not edits.

What misleads

High-contrast edges are always bright. On a set of real badge photos we tested, 99% of pixels changed by at most 2 to 4 levels out of 255 when saved again, structure appeared only at 32 to 64 times amplification, and what lit up was every high-contrast edge: the edited fields, but also the organization name, the logo and the border of the ID photo. So compare bold text with bold text and small text with small text, and never treat a bright area on its own as an edit. Barcodes, QR codes and the edges of the paper will always glow.

Step 5: Cross-check with the tamper check

The tamper check outlines and numbers the regions its model believes were edited with image software, each with a confidence. Use it as a list of places to visit in the four views. On a badge photo whose department field had been replaced in image-editing software, it outlined exactly that field at 99% confidence.

• A numbered region that also stands out from its peers in the channels and shows a patch in the error level view is a strong, multi-source finding.
• A region on a logo, a stamp or a barcode with nothing unusual in the views is more likely an artifact of compression or scanning.
• “No edits detected” does not clear a field. Careful edits can be missed. Check the fields that matter by hand anyway.

Putting it together

Documenting what you found

• Crop the suspect field and one peer from the original and from each view that shows the difference, at the same scale, side by side.
• State the comparison in words and numbers: “In the magenta channel the total reads about 150, against about 105 for the item prices printed in the same pass.”
• Record the file's provenance and the report's note on the error level view, so the reader knows how much history the file carried.
• Print the report and keep it with the case file.

The views do not decide anything. Used in this order, with peers chosen before you look, they turn “something looks off” into a specific, reproducible observation that someone else can check.