In our investigations, we have started seeing offenders use artificial intelligence to create fabricated text conversations and emails. These materials can provide an apparent explanation for a transaction, suggest that a victim authorized an action, or create the impression that someone made a statement they never made. When presented convincingly, a manufactured conversation can influence how an investigator understands the people and events involved in a case.
Fabricated evidence is not new. What concerns me is the ease with which someone can now produce material that looks familiar and credible. Investigators routinely review messages and emails to establish relationships, reconstruct events, and evaluate intent. That familiarity can become a weakness if we allow the appearance of a conversation to substitute for verification that it occurred.
What does the evidence actually establish?
A screenshot establishes that an image contains certain words. By itself, it does not establish who wrote them, whether they were sent or received, or whether the image accurately represents the original exchange. A forwarded email raises similar questions about its origin, completeness, and whether its contents have been altered.
Those distinctions matter when a communication becomes central to an investigative decision. A message that appears to show permission could change how we interpret a financial transaction. An apparent admission could direct attention toward a particular person. An incomplete exchange could make an innocent statement appear incriminating.
Before relying on that material, we need to ask what we have actually established and what we are still assuming.
Follow the evidence to its source
This is why I emphasize obtaining relevant records through the appropriate legal process and examining phones and other electronic devices when there is a lawful basis to do so. An investigator should not allow the material a suspect chooses to provide to define the limits of the investigation.
Subpoenas, search warrants, and other lawful means of obtaining evidence have distinct requirements and purposes. The appropriate process depends on the records sought, where they are held, and the circumstances of the case. They are not interchangeable, and the legal authority to obtain particular records does not automatically authorize a search of someone’s device. Do your work and obtain the correct legal documents to protect the evidence.
The investigative objective is to move beyond a selected presentation and examine the underlying information where it is available. That may involve relevant account records, message data, email headers, transaction records, or information obtained independently from another participant. Availability varies, and no single source should be assumed to contain a complete history.
Finding a screenshot on a phone still does not prove that the conversation depicted in it occurred. It establishes where that image was found. Determining what it represents requires further examination.
Consider an apparent authorization
Imagine an investigation involving money transferred from an older adult’s account. The person who received the money provides a screenshot in which the account holder appears to approve the transaction. The exchange looks ordinary. The wording is plausible, and the timing appears consistent with the transfer.
That screenshot deserves examination. It should neither end the inquiry nor be dismissed simply because the person supplying it is under investigation.
The investigator needs to determine whether the underlying exchange can be located, whether the accounts or numbers can be connected to the people involved, and whether independent records support the explanation. The surrounding conversation may also matter. Permission for one transaction does not necessarily establish permission for another. Again, do the work.
If the message cannot be located elsewhere, that absence must also be interpreted carefully. Missing data alone does not establish fabrication. The question is what the available evidence, considered together, supports.
The same examination could reveal that the screenshot was manufactured, that it omitted important context, or that it accurately documented permission. A sound investigation must remain open to each possibility.
Preserve the evidence and explain the reasoning
Verification depends on careful preservation and documentation. Investigators should record where material came from, how it was obtained, and how it was handled. Appropriate forensic procedures help preserve the information available for examination and support an explanation of the findings.
The distinction between an observation and a conclusion belongs in the report. “The individual supplied an image depicting an exchange” describes what was received. “The account holder authorized the transfer” is a conclusion that requires additional support.
Clear reporting makes those limits visible to prosecutors, defense counsel, and the court. It also allows another investigator to understand how the evidence was evaluated and where uncertainty remains.
Apply the same scrutiny in both directions
The responsibility to verify evidence extends to material supplied by victims and witnesses as well as suspects. It also applies when a message appears to confirm exactly what we already believe happened. Evidence that fits our expectations can be particularly easy to accept without sufficient examination.
This is an important lesson for criminal justice students and working investigators alike. The challenge is not simply recognizing an obvious fake. It is developing the discipline to question convincing material, pursue available corroboration, and explain both the findings and their limitations.
AI gives us another reason to practice that discipline. Our responsibility remains to establish what happened as accurately as the evidence permits. A convincing screenshot is still something we have to verify.
Hunter J. Aldridge
Grounded in experience, committed to learning.
hjaldridge.com