There is no universal way to find out scams. If the scam is done well, it will look like the best project. There are obvious signs, for example, using someone else's photos in the team section. But this happens very rarely.
May disagree, because there are some universal methods exactly. As you said that photos can be stolen - it is really easy checkable information, also team members provide their personal information like LinkedIn account, FaceBook, Twitter and others, and if they are real, there is less chance to be scammed. Also check information about the website, recheck if team had mentioned participation in previous projects, see github, and so on.
I prefer to go another way - I don't need to prove that ICO is scam because they all are scam for me
I prove that ICO is NOT a scam, spot good ICO that use escrow for example. If I found good(not "not bad") I can invest