Can You Trust That Screenshot?
By Dean Benard
There was a time, not all that long ago, when the evidence in an investigation was mostly people. We interviewed the parties and the witnesses, looked at a few documents, and did our best to work out what happened. Today, whether I am looking into a harassment complaint in a workplace or a complaint to a regulator about one of its members, the file almost always arrives with a folder of screenshots attached. Text messages, Teams chats, social media posts, website captures, voice notes, a recording someone made on their phone… it is all there, often before anyone has decided whether an investigation is needed.
That is mostly a good thing, because digital evidence can be enormously helpful. It is contemporaneous, it captures the words people actually used, and it can settle a dispute that would otherwise come down to one person’s memory against another’s. However, I have noticed that we tend to treat it with a level of trust we would never give a witness. A screenshot looks like a fact, and it is very easy to forget that it is really just a picture of something, taken by someone, at a time and for a reason we may know nothing about.
Screenshots and Messages: Easy to Make, Easy to Change
I would point out, first of all, that a screenshot is only an image of a screen, and anyone with a phone and a few minutes can change what appears on it. Names can be edited in a contact list so a message seems to come from someone else, text can be altered with basic editing apps, and there are websites that will generate a convincing fake conversation in seconds.
Of course, the vast majority of screenshots I see are exactly what they appear to be. The more common problem is context. A screenshot shows what the person chose to capture, which means it can leave out the message just before, the reply that softened it, or the weeks of friendly banter that make a crude joke read very differently. Messages can also be edited or deleted after they were sent, so the version captured on Tuesday may not match what is on the device today.
Regulatory files add their own wrinkle. A lot of the evidence comes from members of the public, who may have captured a text from their practitioner, a social media post, or an online advertisement from someone practising without a licence. Websites and posts change or disappear, so a capture with no date, no web address and no sense of who took it is much weaker than it looks. Screenshots still have real value in both settings, but they should be treated like any other evidence, as something to be tested and not simply accepted.
Voice Notes and the New Problem of AI Audio
Audio used to feel like the gold standard. If you had someone’s voice saying the words, there wasn’t much left to argue about. I am not sure we can say that anymore. Voice cloning tools are widely available, some of them free, and it takes a surprisingly short sample to produce a recording of someone saying things they never said. For anyone who has been on a video call, left a voicemail or posted a video online, that sample already exists.
I don’t want to overstate this. A fabricated recording is still unusual, and I suspect most of the audio we receive is genuine. But there is no reliable button you can press to tell whether audio is real, and a clean result from a detection tool should not be mistaken for proof. The other side matters just as much. A respondent or a member confronted with a genuine recording may simply say “that’s not me, it’s AI,” and that claim needs to be tested too rather than dismissed.
When Should You Look More Closely?
Not every screenshot needs a forensic examination, and sending every text message to a lab would be neither practical nor proportionate. In my experience, though, there are some situations where it is worth slowing down:
Getting It Right Without Overreaching
The simplest step is often the most useful one, and that is to ask for the original. That might mean having the person show you the message on their own phone, providing a full export of the conversation, or forwarding the original email with its headers intact. Asking the other party for their copy of the same exchange is another quick check, and the two versions don’t always match. For online material, capture it yourself as early as you can, with the date and web address recorded.
When something genuinely needs verifying, that is the time to bring in a qualified digital forensics examiner, and to do it early, before devices are wiped or replaced. Proper collection preserves the metadata and documents how the evidence was handled. That matters in any investigation, and it matters even more in regulatory work, where the evidence will likely be tested by counsel at a hearing. What I would caution against, in HR offices and regulators alike, is anyone poking around in someone’s phone themselves, which can damage the evidence and create privacy problems of its own.
Fairness applies here as it does everywhere else. If you are going to rely on a message or recording against someone, whether an employee or a member, they should see it and have a chance to respond, including the chance to say it isn’t genuine.
A Call to Action
The lesson is clear. Digital evidence is now part of almost every investigation, workplace and regulatory alike, and it is only going to get more complicated as the tools for creating and altering it get easier to use. That doesn’t mean becoming cynical about every screenshot, because most are exactly what they seem. It does mean we owe it to everyone involved to ask where the evidence came from before we build findings on it.
This is a call to action for HR professionals, regulators and investigators to treat a screenshot the way we would treat a witness, with an open mind, some healthy curiosity, and a willingness to check. After all, a finding is only as trustworthy as the evidence underneath it.
