Proof at the point of capture.

01Real estate: $275 million in losses, and photos lend the credibility

1.1Real estate fraud is mostly about identity

The FBI's Internet Crime Complaint Center counts 12,368 real estate complaints and $275,110,419 in losses for 2025. The comparable figures are $173.6 million for 2024 and $145.2 million for 2023, so losses rose 89% in two years [1]. Victims aged 60 and over account for about $123.7 million of the 2025 total, roughly 45%.

• $275.1Mreal estate fraud losses reported to the FBI IC3 in 2025, up 58.5% in a year [1]
• 89%rise in reported real estate losses in two years, from $145.2 million in 2023 [1]
• 59%of title firms reported a seller-impersonation attempt in the prior year, up from 28% in 2024 [12, 2]
• 58%of title professionals had encountered deepfaked images or voices [2]

Figure 1. Real estate fraud losses and victim counts reported to the FBI Internet Crime Complaint Center, 2022–2025. Losses fell from $396.9 million in 2022 to $145.2 million in 2023, then rose to $173.6 million in 2024 and $275.1 million in 2025 [1, 64].

The real estate count understates the problem, because IC3 assigns each complaint a single crime type. Closing-wire fraud often lands in business email compromise (BEC), which cost $3.05 billion in 2025. IC3's BEC definition explicitly covers compromised "virtual meeting applications", and it names voice cloning as a way to request wire payments [1].

In 2025 IC3 also reported, for the first time, an "AI Related" descriptor: 22,364 complaints and $893.3 million in adjusted losses. Only 115 real estate complaints ($2.7 million) carried it. The descriptor applies only when the victim mentions AI, and there is no earlier year to compare against. IC3 itself warns that victims often "do not realize the extent AI may be involved", so the small figure is a floor, not evidence that AI plays a minor role [1].

Rental fraud shows how real photos serve fake identities. The FTC counts nearly 65,000 rental-scam reports and about $65 million in losses from January 2020 to June 2025, with a $1,000 median loss. Its main technique is copying a legitimate listing, often a property actually for sale, changing the contact details and reposting it. Only 4.8% of mass-market fraud victims complain to a government body or the BBB, so reported figures understate actual harm [11].

Sales fraud follows the same pattern at higher stakes. The American Land Title Association's 2026 study surveyed 245 title professionals. 59% reported a seller-impersonation attempt in the prior year, up from 28% in 2024, and 45% in the prior 30 days. Vacant land was the top target, cited by 82% [12, 2]. 58% had encountered deepfaked images or voices, a tool not listed at all two years earlier. That figure measures perceived prevalence, not attack frequency [2]. On June 16, 2026 the FBI issued a public service announcement on vacant-land seller impersonation built on stolen personal data, fake IDs and VoIP numbers [13].

The clearest documented U.S. deepfake attempt came in Hallandale Beach, Florida, in September 2024. A title company stopped a vacant-lot sale after the purported seller appeared on a Zoom verification call that "was clearly not a real person". The face was built from images of a missing California woman [14]. A person caught the fake by noticing non-human video and mismatched records. No detection tool was involved. The industry's standard fix, "verify by video call", has itself become an attack surface.

1.2Listing photos carry the most weight in a buyer's decision

Listing imagery matters because buyers rely on it more than on anything else online. In NAR's 2025 Generational Trends report, 83% of buyers who searched online rated photos "very useful". Photos ranked first of 14 website features, ahead of detailed property information (79%) and floor plans (57%), and 51% of buyers found the home they bought online [15].

Most listing manipulation is "shallow": sky replacement, object removal and virtual staging, not generative deepfakes. NAR treats these edits under Code of Ethics Article 12's duty to "present a true picture", and urges agents to review all marketing images before publishing [16, 17]. The only quantitative prevalence estimate of altered U.S. listing photos the research found came from a vendor and was excluded from this report. Independent prevalence measurement is an open gap.

02Insurance: a $308.6 billion baseline as policyholders take the pictures

2.1The baseline and its caveats

The Coalition Against Insurance Fraud's widely used baseline puts U.S. insurance fraud at $308.6 billion a year, about $45 billion of it in property and casualty. CAIF also says fraud occurs in about 10% of P&C losses [18, 19]. Both figures need caveats. The total is a 2022 compilation, not a measurement. A Rutgers Law School report calls it "based on faulty research methodology" [20]. It also predates any AI-specific data, and no CAIF figure yet isolates manipulated media.

2.2What claims professionals report

The best current window into manipulated media is Verisk's 2026 State of Insurance Fraud study. It surveyed 1,000 consumers and 300 claims professionals in December 2025 and January 2026. Verisk sells media-forensics tools, so treat the study as vendor research, and the figures are self-reported perceptions, not measured fraud rates. 99% of insurers said they had encountered manipulated or AI-altered documentation, and 76% said these submissions grew more sophisticated over the past year. 36% of consumers would consider altering a claim photo or document, including 55% of Gen Z. 13% consider creating a photo of damage that never happened acceptable [3].

• 99%of surveyed insurers have encountered manipulated or AI-altered documentation (Verisk, vendor survey) [3]
• 36%of surveyed consumers would consider altering a claim photo or document, including 55% of Gen Z [3]
• 60%of insurer-required U.S. home inspections are now do-it-yourself, per vendor executives [23]

Most edits consumers called acceptable were benign, led by brightness or contrast (52%). 53% of insurers think at least half of policyholders who alter claim media do not realize it might be fraud [3]. Verisk and CAIF presented similar survey findings to the NAIC Antifraud Task Force, whose draft minutes record that 33% of respondents would be willing to use AI to manipulate a claim image [21].

2.3Photo-first claims and do-it-yourself underwriting

Two structural shifts are widening the exposure. Photo-first claims are mainstream. CCC launched photo-based touchless auto estimating in 2021 with four national insurers, including USAA [22]. Underwriting has moved into the policyholder's hands as well. An estimated 60% of insurer-required U.S. home inspections are now do-it-yourself, and 80% of insureds choose a digital self-survey when offered. The software behind it is used by three of the top five U.S. personal-lines carriers [23]. Those figures come from vendor executives quoted by Insurance Journal. Once the insured takes the photo, image integrity becomes an underwriting input as well as a claims input.

The risk also runs in both directions. After Hurricane Ian, independent adjusters alleged that carriers had altered their damage reports, cutting estimates by up to 80% while keeping the adjusters' names on them. Florida closed the inquiry for lack of witness participation [24]. Evidence integrity therefore protects every party in a claim, not only the carrier.

The research found no public U.S. prosecution specifically for an AI-altered damage photo. U.S. cases involve fabricated invoices, staged physical damage and altered reports, charged under general fraud statutes. This likely reflects under-detection and charging practice more than absence.

03Why metadata fails

3.1Metadata proves nothing when it is present and is usually missing

EXIF and XMP are self-asserted, unsigned data. NIST's federal reference on synthetic content, AI 100-4, states that anyone copying or editing a file "can then manipulate or falsify the metadata in the versions they create and distribute". It adds that metadata "can similarly be stripped altogether, as it often is when files are shared (e.g., via social media platforms)" [4].

The underlying platform measurement is old. A 2013 IPTC test reported by the Library of Congress found that several popular services strip embedded metadata. Removing one field there often takes captions, location and capture date with it [25]. The research found no rigorous 2023–2026 measurement for individual platforms, and current blog claims contradict each other. A screenshot creates a new file whose only metadata comes from the screenshotting device.

Two implications follow. A timestamp or GPS tag in a claim photo establishes nothing on its own. Its absence is the normal state of shared media, not a red flag. Advice to put "date stamps" on home-inventory photos, as the California Department of Insurance recommends, produces exactly this kind of editable claim [26].

04Why detection fails

4.1Detectors guess, they degrade, and they can be defeated

NIST describes automated detection as "a constant cat-and-mouse game". Detectors "may only perform well on specific generators". In cross-generator tests after compression and resizing, cited studies report 61–70% accuracy in one paper and 50–62% in another [4]. The pattern holds across benchmarks.

• 65.18%accuracy of the winning Deepfake Detection Challenge model on unseen videos, down from 82.56% [5]
• 0.0005AUC left after flipping the lowest bit of each pixel against a 0.95-AUC detector [6]
• 48%human accuracy classifying StyleGAN2 faces, near chance [31]

DARPA's Semantic Forensics program concluded that "purely statistical detection methods are quickly becoming insufficient" [30]. Inpainting, which matters most for property and damage photos, is especially hard. NIST notes that with partially synthetic content "most of the content will be real" [4].

4.2Human review does not close the gap

In PNAS, participants classified StyleGAN2 faces with 48% accuracy, near chance, and rated the synthetic faces 7.7% more trustworthy than real ones [31]. A 15,016-person MIT study found that crowds and the leading DFDC model were similarly accurate. When participants were shown an inaccurate model prediction, their own accuracy often dropped [32]. A Communications of the ACM study of 1,276 participants found detection "as good as a coin toss" across images, video and audio, and self-reported expertise did not help [7].

Insurers' own numbers point the same way. Only 32% are "very confident" identifying deepfakes. 38% say their tools miss too many altered images, and 35% report false positives [3]. The Casualty Actuarial Society's Actuarial Review reports that AI tools and consumer tactics "seem to continuously outpace" insurer detection [33].

4.3False positives are the decisive failure

False positives are the decisive failure for these industries. NIST warns that labeling human-made content as AI-generated "can be extremely damaging" and recommends reporting detection rates at very low false-positive thresholds [4]. Mislabeling a legitimate claim photo means wrongly delaying or denying a claim. Debevoise warns insurers against exactly that kind of overcorrection [34]. A detector score can raise a flag. It cannot clear a photo.

Regulators also police accuracy claims. The FTC's final order against Workado, whose AI-content detector was advertised as "98 percent" accurate but tested at 53% on general content, requires "competent and reliable evidence" for any such claim [35, 36].

4.4Invisible watermarks do not rescue detection

NIST reports that "most current watermarking schemes have been consistently found vulnerable to removal" [4]. A NeurIPS 2024 paper from UCSB, CMU and Berkeley proves that pixel-level invisible watermarks can be removed by adding noise and regenerating the image [37]. University of Maryland researchers showed that watermarks can also be spoofed onto real photos so they test as AI-generated [38]. Watermarks cover only cooperating generators, so a missing watermark proves nothing. A forged one could even be used to cast doubt on a genuine claim photo.

05C2PA: the right cryptography, not yet the coverage

5.1A Content Credential notarizes bytes and a signer, not truth

A C2PA Content Credential is a signed manifest of assertions about an asset. It is tied to the exact bytes by cryptographic hashes (a "hard binding"), so any tampering "will invalidate one or more hashes". It is signed with X.509 certificates and SHA2-256. A watermark or fingerprint (a "soft binding") can help find the manifest again after it has been stripped [39].

The standard is "currently on version 2.4". A Conformance Program launched on June 4, 2025 now governs which signers count as trusted [9, 40]. C2PA's guidance distinguishes "Valid", meaning cryptographically intact, from "Trusted", meaning the signer is on the C2PA Trust List [9]. NIST states the boundary plainly. A signature "cannot verify that the metadata is accurate; on a technical level, it merely serves a notarization function" [4]. C2PA agrees that provenance "cannot tell you whether the digital content is true, accurate or factual" [39].

5.2Membership is broad, but shipped capture signing is thin

The institutional backing is real. The steering committee includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis, Sony, TikTok and Truepic [41], and C2PA reports more than 6,000 members and affiliates [42]. Shipping conformant code lags far behind. As of May 14, 2026, 54 products from 31 companies had passed conformance [9].

• 6,000+C2PA members and affiliates [42]
• 54products from 31 companies had passed C2PA conformance as of May 14, 2026 [9]
• 2.4the current version of the C2PA standard [9]

On the capture side, the Pixel 10 is the reference implementation. Google says it is "the first to have Content Credentials built in across every photo created by Pixel Camera", at Assurance Level 2. Keys sit in hardware (StrongBox on Titan M2), each certificate signs exactly one image, and the CAs keep no logs [8]. Most other deployments label AI generation or AI edits rather than certifying real captures. The research found no primary source confirming native C2PA capture signing on iPhone, which leaves a large share of brokers, adjusters and policyholders without hardware-level capture credentials.

5.3Display is uneven, and credentials get stripped

Display is uneven. YouTube's "Captured with a camera" label requires a C2PA 2.1+ capture tool and no edits to the sound or visuals [43]. LinkedIn acknowledged in 2024 that it could not yet identify and label all AI content [44]. C2PA's own guidance warns that screenshots and re-exports strip credentials, and that "No Content Credentials found" may simply mean they were removed [9].

NIST adds a privacy cost. Provenance metadata "could leak sensitive metadata", and when a credential points to an external URL, "attempts to access that URL can be tracked" [4]. WITNESS, which led C2PA's harms work, warns that location assertions can expose people who did not intend to share them [45].

The practical conclusion: an AI label is a negative signal that disappears when stripped, leaving content "unlabeled", not "real". Only signed capture provenance makes a positive claim that can be checked. Even that claim is limited to "captured by this device or app, unchanged since signing."

06Regulation and evidence: converging on provenance without mandating a technology

6.1California now requires a public link to the original listing photo

AB 723 (Chapter 497, Statutes of 2025; Bus. & Prof. Code §10140.8) took effect January 1, 2026. If a California licensee advertises with an image "altered through the use of photo editing software or artificial intelligence" to add, remove or change elements, the ad must carry a "reasonably conspicuous" disclosure "on or adjacent to the image". It must also link to a publicly accessible URL or QR code that "clearly identifies the original, unaltered image". Covered elements include fixtures, furniture, flooring, walls, paint, landscape and window views. Routine "lighting, sharpening, white balance, color correction, angle, straightening, cropping, exposure" adjustments are exempt [10].

The California Association of Realtors opposed the bill, and the Consumer Federation of California supported it [10]. Outside California, NorthstarMLS proposed guidance in May 2026 calling for disclosure and an unaltered "before" image alongside any AI-enhanced or virtually staged photo [46]. AB 723 assumes a trustworthy original exists but says nothing about how anyone can tell that a file is the original. A capture-time hash and verification link fill that gap. The statute does not require one, and using one does not create a compliance safe harbor.

6.2The California AI Transparency Act and federal proposals

The California AI Transparency Act (SB 942, 2024, as amended by AB 853, Chapter 674, Statutes of 2025) became operative August 2, 2026. Its base duties require large GenAI providers to offer detection tools and embed latent disclosures in AI output, with $5,000 penalties per violation [47, 48]. From January 1, 2027, large online platforms must detect and surface standards-based provenance data. From January 1, 2028, manufacturers of capture devices sold in California must give users an option to embed a latent provenance disclosure: manufacturer, device and capture time [49].

Sources disagree on whether the enacted text bans tools built to remove provenance, so check the chaptered text before relying on that point. These duties fall on generators, platforms and device makers, not on capture apps. They make capture-time provenance a statutory expectation in California. At the federal level, the COPIED Act, which would have NIST develop provenance standards and outlaw tampering with provenance data, was reintroduced in April 2025 and has not passed [50].

6.3Insurance AI rules govern the insurer's algorithms, not the claimant's evidence

The NAIC Model Bulletin on the Use of AI Systems by Insurers (adopted December 4, 2023) has been adopted in roughly half the states. Law-firm trackers counted 24 states in March 2025 and about 25 by 2026 [51, 52]. NY DFS Circular Letter No. 7 (2024) sets governance, fairness-testing and vendor-oversight expectations for AI and external data in underwriting and pricing [53]. Colorado's SB21-169 bars unfairly discriminatory use of external data and models [54].

All three regulate how insurers use AI. None sets a standard for authenticating policyholder-submitted media, and the research found no NAIC or state guidance on minimum authentication standards for claim photos. Fabricated images are already covered by general fraud statutes: California Penal Code §550 covers false statements in support of a claim, and New York Penal Law §176.05 covers written statements containing materially false information. Neither statute names AI [55, 56].

In practice, claims teams are left with Debevoise's advice to collect multiple angles, native original files, live video inspections and more site visits [34]. That is effectively a manual provenance request. Verisk's respondents see the same trajectory: 45% expect stricter proof-of-loss requirements within three to five years [3].

6.4Evidence law already accepts hash-verified process records

Under FRE 901(a), authentication requires only evidence "sufficient to support a finding that the item is what the proponent claims it is". Rule 901(b)(9) allows authentication by "evidence describing a process or system and showing that it produces an accurate result" [57]. FRE 902(13) and (14), in force since December 2017, allow self-authentication by certification for records generated by an accurate electronic process and for data copies verified "by a process of digital identification", which the committee note ties to hash values [58]. A capture-time record with a content hash, device, time and stable verification link maps directly onto these routes.

AI-specific reform has stalled. Proposed FRE 707, on machine-generated evidence, went out for public comment from August 2025 to February 2026. In June 2026 the Standing Committee sent it back for further study [59]. A deepfake-specific draft Rule 901(c), which would require a challenger to first show evidence of fabrication, was never formally proposed and was tabled in May 2026 [60]. As of October 2026 the FRE contain no deepfake rule.

Contemporaneous provenance is therefore the strongest available answer to both a fabricated exhibit and a "liar's dividend" claim that genuine media is fake. Most insurance disputes, however, run through state courts, appraisal or arbitration under state evidence codes, which this research did not cover.

07Capture-first provenance and two link types

7.1What capture-first provenance changes

Capture-first provenance changes the question. Instead of asking "does this look fake?", it asks "can this file be traced to a specific capture, unchanged since?" Answering that does not require knowing which generator produced a fake. NIST frames provenance and detection as complementary. Provenance "can be applied to both synthetic and non-synthetic content", and checking it is "relatively straightforward". Content-based detection, by contrast, needs evaluation datasets NIST says are still hard to build [4]. Controlled capture also has a commercial track record in insurance, where carriers already rely on in-app capture for policyholder self-inspections [23].

Apex Verify applies this model at the app layer. Only captures made in Apex Camera earn proof, while camera-roll imports, screenshots, re-uploads and AI output never do. Each capture gets a content hash and a verification record held off-file. That record survives the platform stripping NIST describes, which matters because NIST notes that external provenance repositories "do not yet exist on a wide scale" [4].

7.2A public link and a private link

Two kinds of link match two privacy needs.

1. Permanent public verification link. Suits media the owner chooses to publish, such as listing originals or marketing images. Permanence is what makes such a link citable, and it fits AB 723's requirement for a public URL or QR code [10].
2. Revocable 24-hour private link. Suits sensitive evidence such as interiors, damage, claims files and deposit disputes. It applies the access limits NIST recommends: people gain "greater control of their privacy if they have the ability to control or delete their metadata", and external lookups can otherwise be tracked [4]. It also matches the NIST Privacy Framework's goals of limiting observability and linkability [61].

Two design rules follow from the same sources. Lookup logging should be kept to a minimum. Revoking a link should end access but keep the integrity record, so later disputes can still be resolved.

7.3Where brokerages and insurers should insert it

Brokers sit at the junction in both industries. Listing agents control originals, and insurance brokers often send inspection requests to clients and pass documentation on to carriers. The research found no source documenting brokers' legal duties or E&O exposure for passing on altered media, so that role is a practical recommendation, not an established obligation.

08Honest limits

8.1What capture provenance cannot prove

A capture record proves less than its users will want. It shows that a file came from a particular capture and has not changed since. It cannot show that the scene was not staged, that the damage occurred on the stated date, that the room is the insured's or that a caption is true. NIST warns that transparency tools "can create a false sense of trust" when legitimate content is reused out of context [4].

Photographing a screen produces a genuine capture of fake content (the "analog hole"), and the research found no primary U.S. study measuring such recapture attacks. App-level signing on iOS also sits at a lower assurance tier than the Pixel 10's hardware-backed keys. Google itself notes that any claim "is fundamentally dependent on the integrity of the application and the OS" [8]. NIST adds that compromised tools can "add or remove data before the signature is generated" [4].

8.2What Apex does not yet do

Apex-specific limits must be stated plainly. Apex does not yet embed certificate-backed, interoperable C2PA credentials in every exported file, so a carrier's or platform's C2PA validator cannot read its records today. Trust currently rests on Apex's own server and its continuity, not on a trust-listed X.509 signer. Adopting C2PA, ideally through the Conformance Program with a "Trusted" signer, belongs on the roadmap; it is not a current feature. Apex detects nothing: a file without an Apex record is unverified, not fake.

Requiring capture-first media also raises fairness and access questions. Not every claimant or tenant has the app. Debevoise's warning against delaying or denying legitimate claims applies equally to demanding provenance in ways that exclude people [34].

8.3Gaps in the evidence base

This paper draws on U.S. government and regulatory documents, statutes and legislative records, standards bodies (NIST, C2PA), industry associations (NAR, ALTA, CAIF, NAIC, CAS), peer-reviewed or archival academic research, major law-firm analyses, and established U.S. trade or news outlets reporting named primary studies. Vendor-sponsored figures (Verisk, EXL/Truepic, CCC) are labeled as such in the text. Unverified vendor blogs, figures available only secondhand and non-U.S. case reports were excluded.

The evidence base has gaps of its own. The fraud-scale figures are victim-reported (IC3, FTC), industry perception surveys (ALTA, Verisk) or contested compilations (CAIF). None measures how often manipulated media actually appears in U.S. claims or listings. No independent benchmark of detector accuracy on insurance claim images was found.

Regulatory points not yet confirmed against chaptered text include AB 723's penalty mechanism, SB 942's provider thresholds and penalty amount, AB 853's removal-tool provision and the exact NAIC adoption count. The fall 2026 outcome of the federal evidence-rules process was not available at the time of writing. Detection retains a role as a complement for the large body of media that will never carry provenance, which is how NIST and leading forensics researchers frame it [4].

09Conclusion

The core shift is from judging content to verifying chains of custody. Every failure documented here, including stripped EXIF, generator-specific detectors, removable watermarks and humans at chance, comes from trying to infer authenticity from a file that has already left the camera. Every rule now arriving, including AB 723's public original, California's 2028 capture-device option, FRE 902(14)'s hash-verified copies and insurers' push for native originals, assumes instead that authenticity can be established at capture and preserved afterward.

Brokerages and carriers do not need to win the detection arms race. They need to decide at which moments they will accept only media with a verifiable capture record: listing originals, move-in photos, self-inspections and first notice of loss. Everything else should be treated as testimony, not proof.

The second takeaway concerns privacy. A trustworthy media system for homes and claims cannot be fully public, because the most valuable evidence (interiors, damage, personal property, location) is also the most sensitive. Pairing permanent public links for published media with expiring, revocable private links for evidence responds to NIST's own warning that provenance lookups can be tracked.

For Apex, the credibility test over the next two years is interoperability. Once its capture records also travel as Trusted C2PA credentials, the off-file verification link becomes a resilience layer on top of an open standard instead of a proprietary substitute for one. Until then, its honest claim is narrow, and the narrowness is a strength: it can be verified.