Altered Proof-of-Life Media in Virtual Kidnapping Scams: How to Verify It

Treat the proof-of-life image as an unverified claim

A text says a loved one has been kidnapped. It threatens violence, demands ransom, and includes a photo or video that appears to show the person. Treat the attached media as the first item to verify.

The FBI warned in December 2025 that criminals were altering photos found on social media or other public sites and using them as fake proof-of-life media in virtual kidnapping ransom scams. According to the notice, the actors commonly contacted targets by text, claimed to have kidnapped a loved one, threatened violence, and demanded payment. They sometimes used timed-message features to reduce the time available to inspect the media.

The notice concerns altered photos and videos. It does not say every file in this type of scam is AI-generated, so do not add that conclusion without separate evidence. A realistic image does not prove a kidnapping, while an obvious visual error does not by itself prove who made the file or why.

Compare details without turning them into a verdict

The FBI says close comparison with confirmed photos may reveal missing tattoos or scars and inaccurate body proportions. Use those details as reasons to continue checking. Do not treat one mismatch as a final determination that the media is altered, and do not treat the absence of a mismatch as proof that it is genuine.

Find confirmed photos you already possessed or can open through an account you trusted before the demand arrived. Compare persistent features, clothing, surroundings, and the visible condition of the person. Record what matches, what differs, and what cannot be seen. Keep uncertainty explicit instead of filling gaps with assumptions.

A timed message increases pressure and adds no independent evidence. If the application permits it, preserve the original message, sender information, time, payment instructions, and attached media without editing the file. Do not delay an emergency call in order to complete a detailed visual analysis.

Contact the person through an independent route

Use a phone number, family contact, workplace, school, or other channel that did not come from the ransom message. Ask a trusted person nearby to check on the loved one if direct contact fails. For an immediate threat, contact local law enforcement through a known official number. These are operational steps proposed by this guide, not procedures quoted from the FBI notice.

Keep the identity check separate from the payment demand. A reply from the same number that sent the threat does not independently confirm the person's location or safety. Do not send money merely to gain more time or receive another image without following the guidance of law enforcement and the relevant payment provider.

Use image or video analysis within its limits

If you have a saved file, DeepFakeCheck can provide a probabilistic risk signal about possible manipulation. It cannot establish whether a kidnapping occurred, locate the person, identify the sender, or decide whether a ransom demand is genuine.

Automated analysis can produce false positives and false negatives. A false positive may flag an authentic file; a false negative may miss an altered one. A high-risk result supports further review. A low-risk result does not authenticate the image or make the demand safe. Preserve the exact file analyzed, the result, and the analysis time so another reviewer can understand which copy produced the signal.

Preserve evidence and report the incident

The FBI asks people who believe they were targeted by this scam to report it to the Internet Crime Complaint Center at www.ic3.gov. Its notice specifically asks for as much information as possible, including phone numbers, payment information, text and audio communications, and proof-of-life photos.

Keep the original demand and your verification notes together. Base the practical decision on independent contact, official assistance, and a record that preserves what was actually received.

Sources

FBI Internet Crime Complaint Center, “Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams”: https://www.ic3.gov/PSA/2025/PSA251205