Fake screenshots

How it works

A screenshot looks like evidence because it looks like a copy. It is not. It is a picture of a screen, and what was on that screen is whatever the person who took it wanted there.

The cheapest version needs no software at all. Open any web page, right-click, choose “Inspect”, and you can rewrite the headline, the tweet, the number of likes. The page redraws instantly, you screenshot it, and the edit lives on only in your image. Fake-tweet generators do the same with a form. Chat screenshots are easier still: a conversation with yourself, two renamed contacts, and a crop.

There are three common flavours. A fake post by a politician or celebrity, usually with a “they deleted it, but I saved it” story attached. A fake headline on a real outlet’s layout, so the newspaper’s reputation carries a sentence it never printed. And a fake chat, which is how “leaked” group messages and “a friend who works there” stories are usually built. EUvsDisinfo has documented pro-Kremlin channels circulating invented BBC and other Western-media screenshots for years; the layout does the lying, and the brand pays for it.

The “deleted” story is the load-bearing part. It explains why you cannot find the original, and it adds a thrill of exposure. A real deleted post almost always leaves traces: an archive copy, replies that quote it, journalists who screenshotted it independently. A fake leaves only the one image.

Example

@civil_watchdog, 5h [image: a tweet by the interior minister, 23:41 last night] “If the courts keep blocking us, we will simply stop publishing their rulings.” Deleted after 12 minutes. I have the receipt.

@dora_ff, 4h Checked the account, the replies and the Wayback Machine for that time window. Nothing. Also, the timestamp is in a format the app does not use. Do you have the archive link?

Notice that the first post offers a story (deleted, twelve minutes, receipt) in place of a link. The second asks for the one thing a real deleted tweet would have: an independent copy.

Why it works on you

• It borrows a real brand. A familiar logo and layout trigger the trust you have built up over years with that outlet or that person (see authority bias). The fake does not need its own credibility; it rents theirs.
• It gives you the catch. A quote you can find in a published article is just news. A “deleted” tweet is a secret, and secrets feel more valuable than facts.
• It confirms the villain. If you already think the minister despises the courts, this is exactly the tweet you expected. That makes you the ideal carrier, because confirmation bias skips the check.

What to do

When someone sends it to you: go to the source, not the image. Open the outlet’s site and search for the headline; open the account and scroll to the date. If it was “deleted”, paste the post’s address into the Wayback Machine (web.archive.org) or search for replies that quoted it. No original, no archive, no quoting replies? Treat it as unproven, however good it looks.

When you catch yourself: read the small print. Date formats, the font, a blue tick on an account that is not verified, a like count that is suspiciously round. Then ask whether anyone else reported it. A minister threatening the courts in public is a front-page story. One anonymous screenshot and silence everywhere else is not.

In a comment section: ask for the link, once and calmly. “Could you post the archive of this?” puts the burden back where it belongs. Do not accuse anyone of forgery; plenty of people share a fake they received in good faith. Link how screenshots are checked and let the missing evidence speak.

Don’t confuse it with

• Real screenshots of real deleted posts. They exist. The difference is that they usually come with an archive link, a timestamp and independent copies, and the person who took them can say when and how.
• Clearly labelled satire. A parody account’s post is not a fake screenshot. It becomes one when the label is cropped off (see satire shared as real news).