Disinformation — SIFT method, lateral reading, and deepfakes

Why verification matters — the situation in brief

Organized disinformation is measurable and documented. The EU's External Action Service (EEAS) recorded in its fourth threat report (2025) about 540 incidents of foreign information manipulation across more than 90 countries, spread via roughly 10,500 channels and websites. About 35 percent of incidents were attributed to state actors (Russia about 29 percent, China about 6 percent); about one quarter of incidents used AI tools. Remaining cases had no clear attribution but showed coordination features.

Switzerland is also in the crosshairs: the Swiss Intelligence Service (SIS) ranks Russia as Europe's greatest and most immediate threat and notes that hybrid conflict — including disinformation — directly affects Switzerland. In 2025, the channel RT-Deutsch broadcast about a quarter more stories about Switzerland than the previous year, often with a narrative of alleged decline. The goal is rarely a single false story, but the gradual erosion of trust in media, authorities, and elections.

Important context: not every uncomfortable or faulty story is a foreign campaign, and real events are sometimes merely amplified in distorted form rather than wholly invented. That's precisely why a verification method based on evidence rather than gut feeling is valuable — and it works the same way regardless of political affiliation.

How do I verify a story with the SIFT method?

SIFT is a proven, easy-to-remember verification routine by media educator Mike Caulfield. It consists of four steps — Stop, Investigate the source, Find better coverage, Trace claims — and can be applied in minutes before you believe or share anything. The most important step is the first: stop.

Work through the steps in order. Usually, even the first two are enough to identify a story as questionable.

1. Stop: Before you react, share, or comment — pause briefly. Do you know the source? Does the story trigger strong emotions? This is exactly when extra caution is warranted, because emotion is the lever by which false information gains reach.
2. Investigate the source: Clarify who is behind the story before you read it. Is it an established newsroom with masthead and named editors — or an unfamiliar site that just looks like a major outlet? Research the source itself, not from within it (see lateral reading).
3. Find better coverage: Are reputable, independent media reporting the same thing? If a supposedly sensational story appears only on one site or network, that's a warning sign. Deliberately search for the story itself, not the headline.
4. Trace claims to the original: Follow quotes, figures, and images back to their original source. Often a real quote is taken out of context, a statistic is outdated, or an image comes from a completely different event. Only the original context shows whether the claim holds.

Lateral reading: investigate a source from outside, not within

Lateral reading means: instead of spending time on an unfamiliar website and judging whether it 'looks credible,' open new tabs and research what others say about that source. Professional layout, a logo, or an 'About Us' section is not proof of trustworthiness — especially because disinformation sites invest heavily in exactly this appearance.

Concretely: search the website or organization name in a search engine, check independent sources and fact-check databases, and verify whether the site has been around for a while or just appeared. Professional fact-checkers work this way — they judge a source from the outside, not based on how it presents itself.

This technique also reveals cloned media (see next section): a site can look exactly like a well-known news portal and still be a forgery. You won't notice it on the site itself, but only when you check from outside.

Verify source and author: masthead, domain, and cloned media

First check the basics: is there a complete masthead with a responsible person and a mailing address? Its absence or vagueness is a clear warning sign. Look closely at the web address (domain): fraudulent sites imitate real media with slightly different addresses or unusual extensions.

Cloning established media is a documented tactic. EU-sanctioned Russian companies Social Design Agency and Structura ran the 'Doppelgänger' campaign, creating stunningly convincing copies of well-known news sites like Der Spiegel, Die Welt, or Le Point — distributed across dozens to hundreds of mirrored addresses. The stories look authentic but don't come from the newsroom whose name they bear.

Practical consequence: don't rely on appearance; instead, navigate to the news site via your own bookmark or a direct search and verify that the story actually exists there. If a story circulates only as a screenshot or forwarded link, healthy skepticism is warranted.

Reverse image search: verify photos and screenshots

Images are a central tool of disinformation because they act immediately. With reverse image search, you upload a photo (or screenshot) or enter its address and find out where it appeared before. This way you recognize if an image comes from a completely different place or time and has simply been re-captioned.

Faked screenshots of real media are a documented tactic: the pro-Russia network 'Portal Kombat' spread, among other things, manipulated screenshots that looked like they came from serious French media. A screenshot is therefore not proof — reverse search and comparison with the original site show whether the representation is genuine.

Also pay attention to context: does the image fit the story temporally and geographically? Are the weather, season, text on signs, or vehicles consistent? Small inconsistencies are often the first hint of a forgery or misattribution.

Emotional triggers as warning signals

Disinformation deliberately targets strong emotions — outrage, fear, anger, or schadenfreude. The reason is simple: emotionally charged content is shared more often and faster, frequently without those sharing it having verified it themselves. A story that makes you immediately angry or perfectly confirms your view of the enemy therefore deserves extra scrutiny, not less.

Typical patterns are sensational headlines in all caps, urgent calls to action ('Share this before it's deleted!'), blanket accusations, and claims that 'the media' or 'those in power' are hiding something. These signals replace evidence with feeling.

The simplest countermeasure is the first step of SIFT: stop. Anyone who notices their own emotional reaction and waits a moment before sharing interrupts precisely the mechanism the campaign relies on.

Bot and troll patterns: recognize coordinated behavior

Part of disinformation's effect comes not from the content but from apparent mass: if many accounts spread the same thing nearly simultaneously, a fringe view looks like broad consensus. Experts call this coordinated, non-authentic behavior. The EEAS report documents networks with thousands of mobilized channels.

Signs of automated or controlled accounts include: very young profiles with no real history, generic or stolen profile pictures, extremely high posting frequency at all hours, repeatedly identical wording, and exclusive focus on a single politically sensitive topic. A single trait proves nothing — the pattern is the signal.

When in doubt, verify not just the story but the account behind it: when was it created, what else has it posted, does the activity seem human? The same caution applies to comment sections, where remarkably identical outrage can look orchestrated.

How do I recognize deepfakes and AI images?

About one quarter of the incidents the EEAS recorded in 2025 used AI tools — for example synthetic voices, faked videos (deepfakes), or AI-generated images. The technology is improving rapidly, so no single feature is certain proof. Multiple anomalies together, however, are a strong indicator.

In images and videos, watch for typical weaknesses: unnatural hands or too many/too few fingers, blurry or nonsensical text in the background, strangely smooth skin, inconsistent shadows and reflections, and ears, teeth, or jewelry that change between frames. In videos, lip movements and audio are often slightly out of sync, blinking looks unnatural.

The most reliable verification remains context, not details: who is supposed to have said or done this, and are serious, independent sources reporting the same? An alleged video of a well-known person that circulates only through obscure channels and is confirmed nowhere else should be treated with utmost skepticism.

Respond correctly: don't spread, verify, report

The most effective response to disinformation is not to give it reach. Anyone who shares a questionable story — even to criticize it — often spreads it further than it would go on its own. Verification must therefore come before reaction.

1. Don't spread unverified stories — not even as an outraged screenshot or 'look what they're claiming.'
2. Verify with SIFT and, if needed, with an established fact-checking service (see resource table). A circulating false story is often already classified there.
3. Report false information on the respective platform rather than commenting on it — comments increase visibility; a report doesn't.
4. In your personal circle, quietly and factually correct, with reference to a reliable source — not with mockery, which hardens positions.
5. In official emergencies, rely on official channels (Alertswiss, authorities, public broadcasting) and not on unconfirmed messages in social networks.

Common mistakes

1. Judging by appearance: professional layout proves nothing — cloned media sites are deliberately designed to be deceptively authentic.
2. Sharing out of outrage: it's precisely the emotional reaction that powers the campaign; sharing increases reach, even with a critical comment.
3. Trusting a single source: if only one site or network reports something 'sensational' and serious media are silent, that's a warning sign, not evidence of a 'suppressed truth.'
4. Treating screenshots as proof: photos of real news sites can be faked — always verify the original site and reverse image search.
5. Overweighting a single bot feature: a new profile alone is not proof; only an accumulation of multiple features points to coordinated behavior.
6. Confusing amplification with authorship: sometimes an event is real and merely amplified in distorted form — amplification is not the same as a wholly invented story.

Important note

This guide serves media literacy and general information. It is intentionally impartial: the verification methods mentioned work regardless of political leaning or topic. Not every uncomfortable or faulty story is an organized campaign — the goal is a scrutinizing eye, not a suspicious one.

The situational figures (EEAS, SIS) are year-bound and regularly updated; current reports are authoritative. In official emergencies, always follow official authorities and Alertswiss (alert.swiss).

The selection is impartial and not exhaustive. When in doubt, use multiple independent sources and verify a claim yourself using the SIFT method. Status: July 2026.

Frequently asked questions

Official sources

• Threat: Disinformation Situation, methods, and attribution overview
• Threat: Cyber attack Disinformation often coincides with cyber operations
• Threat: Communication failure Why reliable information channels matter in crisis
• Guide: Crisis team and response time How authorities inform and lead in emergencies
• EUvsDisinfo (EEAS) Database and analysis of foreign disinformation
• Youth and Media (Federal government) Media literacy and disinformation response
• ch.ch – Recognize disinformation online Official Swiss guidance
• EDMO European network of fact-checkers and researchers
• Guide: Protect yourself from shock calls AI voice clones on the phone – recognize and respond correctly
• Guide: Reporting clearly with SALUTE and the W-questions Observation or hearsay? Passing on reports carefully