The disclosure relates to a method for detecting a tampered metal item (FC), in which a non-metallic substance is concealed and which has been tampered with in such a way that the tampered metal item (FC) produces a two-dimensional X-ray image comparable to a corresponding non-tampered metal item, in two-dimensional X-ray data of an inspection object (O1, O2, O3) containing the metal item (FC), the method including (S10) determining a region containing a metal item (FC), (S20) providing an attenuation curve (D(r)) for or intensity curve (I(r)) of detected X-ray radiation along a line (L) through said metal item (FC), (S30) evaluating whether the attenuation curve (D(r)) or the intensity curve (I(r)) shows a characteristic anomaly (P1, P2) in a predetermined area, and when the attenuation curve (D(r)) or the intensity curve (I(r)) in the predetermined range shows the characteristic anomaly (P1, P2), (S40) triggering an alarm function.