Can Text Messages and Screenshots Be Faked? What Forensic Review Actually Shows

31 Dec Can Text Messages and Screenshots Be Faked? What Forensic Review Actually Shows

Posted at 11:22h in Phone and Digital Evidence by

Yes. Text messages and screenshots can be faked, and it doesn’t take skill. Anyone with a phone and five spare minutes can produce a conversation that never happened and make it look exactly like the real thing.

The better question is whether anyone checks. In most of the cases I see, nobody does. A screenshot gets attached to a police report, a protection order application or a custody filing, and from then on everyone treats it as a record of what was said.

Here’s how fakes get made, why they still make it into court, and how forensic review catches them.

Five ways a fake conversation gets made

  1. Change the contact name. This is the easiest one, and it fools people constantly. Save any number in your phone under someone else’s name, text yourself from it, and screenshot the thread. The screenshot shows the name, not the number. It looks like a message from that person because the phone was told to label it that way.
  2. Use a fake-message generator. Free apps and websites recreate iMessage, WhatsApp and SMS screens. You type both sides of the conversation, pick the times, set the battery level, and export an image that matches the real interface pixel for pixel.
  3. Edit the page before the screenshot. Web versions of messaging apps run in a browser. A browser’s developer tools let anyone change the text on the page, and the screenshot then captures the edited version. Nothing on any server ever changed.
  4. Edit the image afterward. Basic photo editing can swap words, times or names. AI tools now do it faster and cleaner, and can generate whole images or voice notes from scratch.
  5. Use real messages selectively. No editing required. Crop out the message before, leave out the one after, rearrange the order. Every word is genuine and the story it tells is false. This is the most common manipulation I see, because nothing about it looks fake.

Why fakes still get into court

The bar for getting a screenshot admitted is low, in both the US and Canada.

In the US, New York’s highest court held in 2022 that someone with personal knowledge of a conversation can authenticate screenshots of it. They don’t need to be the person who took the screenshot. Other courts have suggested that expert testimony might sometimes be necessary, but the general standard is easy to meet.

In Canada, the Canada Evidence Act requires that electronic documents be authenticated (s. 31.1) and that the integrity of the system that stored them be shown (s. 31.2). The threshold is low here too. Quebec’s Court of Appeal has said that questions about reliability and possible manipulation are generally weighed at the end of the trial, not at the admissibility stage. Courts do sometimes exclude screenshots: the BC Supreme Court refused WeChat screenshots in Wang v Liu (2023 BCSC 972) because they weren’t properly authenticated. But that’s the exception.

So the real fight usually isn’t whether a screenshot gets in. It’s how much weight it carries once it’s in. That’s where forensic review earns its fee.

What a screenshot can't tell you

A screenshot is a picture of a screen. On its own it can’t show:

  • Which device the conversation lived on, or which account sent it
  • The phone number behind the contact name
  • Whether the image was edited, cropped or generated
  • When the screenshot was taken, as opposed to when the messages were sent
  • What came before and after the part you’re shown

Without those answers, a screenshot is an orphan. It exists, but nothing anchors it to what happened.

How forensic review tests a message

The message lives in a database on a phone, in an account and often on a server. The screenshot is just a picture of it. Testing a screenshot means going back to the source.

Check both ends. A real message exists on the sender’s device and the recipient’s device. When both phones are available, the records should match: content, timestamps, thread order, sender identity. A message that exists on only one side needs an explanation.

Check the identity, not the label. In the phone’s records, every message ties to a phone number or account ID, not to a display name. The contact-name trick dies the moment someone looks at the number.

Check the database, not the display. Messaging apps store conversations in structured databases on the device. A fabricated screenshot has no matching record. An edited one has a record that says something different. Deleted messages sometimes leave traces too, and a forensic extraction can show where the thread has gaps.

Check the image itself. Screenshots are files with their own creation times. The status bar is evidence too: the clock, the battery level and the signal shown across a series of screenshots should make sense in sequence. A battery that jumps from 12% to 80% between two screenshots supposedly taken a minute apart is a question. So is an interface design that doesn’t match the operating system version the phone was running.

Check outside the phone. Carrier records show that an SMS was sent between two numbers at a given time, though not what it said. Platform records and account data can confirm activity for apps like WhatsApp or Messenger. When the screenshot says one thing and the records say another, the records win.

Put it on a timeline. Line the messages up against everything else: calls, locations, other conversations, what the people involved were doing. Fakes and cherry-picked threads rarely survive being placed in sequence.

Real messages, false picture

Not every misleading screenshot is fake. A message that looks threatening on its own may be a reply to days of provocation that didn’t make the cut. A calm message may follow a week of pressure. When someone hands over twelve screenshots out of a two-thousand-message thread, the question isn’t only whether they’re real. It’s what the other 1,988 messages say.

That’s why the full conversation, pulled from the device, matters more than any selection of images.

If screenshots are being used against you

If you’re facing an accusation, a protection order or a custody fight built on screenshots, do these things now:

  • Keep your phone exactly as it is. Don’t delete messages, threads or apps, even ones that embarrass you. Deleting looks like guilt and destroys the records that can prove a fake.
  • Don’t reply or confront. Anything you send now becomes part of the record.
  • Back up the device to a computer or the cloud, and don’t factory reset or replace the phone.
  • Write down what you remember: dates, what was actually said, who else saw it.
  • Tell your lawyer the screenshots may be fake or incomplete, and ask them to request the originals and a forensic review. Your phone may be the best evidence you have.

Questions counsel should ask about any screenshot

  • Who took it, on which device, and when?
  • Is the original device available, and has it been forensically extracted?
  • Does the thread exist on the other party’s device too, and do the records match?
  • What number or account sits behind the contact name?
  • Is this the whole conversation? If not, where’s the rest?
  • Do the status bar times and battery levels make sense across the series?
  • Do carrier or platform records line up with the messages shown?

The takeaway

A screenshot proves someone had an image of a screen. Everything else (who sent it, what it said, what surrounded it) has to come from the source. If nobody has checked the source, nobody knows.

If a case turns on screenshots, start with a TruthScan. It’s a flat-rate review that tells you whether the messages hold up, where they don’t, and what to ask for next. If the phone extraction itself is in question, see independent Cellebrite report review.

Sources