Safety & harassment
Spotting fake and impersonation accounts
How to tell a cloned profile from the real person, what impersonators are usually after, and the steps that actually get a fake account removed — including when the person being impersonated is you.
Impersonation is one of the most common problems on any social platform, and one of the least dramatic to look at. There is no exploit involved. Someone copies a photo, copies a name, and starts talking to people who have every reason to believe them.
The damage comes from that borrowed trust. This guide covers how to recognise a fake, what to do when you find one, and what to do when the person being copied is you.
What impersonators are usually after
Understanding the goal makes the signals easier to read. Most fake accounts fall into one of four categories.
Financial scams. The account rebuilds a relationship you already have, then introduces a request for money — an emergency, an investment opportunity, a favour that needs to happen quickly. The relationship is the product; the request is the point.
Credential theft. The account sends a link. The link leads to something that looks like a login page. This is phishing wearing a friend's face, and it works far better than a generic email because the message arrives from someone you know.
Harassment. An account created specifically to contact someone who has blocked the person behind it, or to post content in a victim's name in order to damage them.
Bulk fakery. Accounts created in volume for engagement farming, spam, or resale. These are usually the easiest to spot, because nobody invested any effort in the individual profile.
The first two are the ones that actually cost people money, and the ones most likely to target the friends and family of the person being impersonated rather than the person themselves.
The signals that actually mean something
Some signals are much stronger than others. In rough order of reliability:
A duplicate of an account you already follow. If you are already connected to someone and a second, near-identical profile appears, treat the new one as fake until proven otherwise. This is the single strongest signal there is, and scammers rely on people not noticing.
A brand-new account with an established person's life on it. Photos spanning years, a full name, a familiar bio — but the account itself was created recently and has almost no history of interaction with anyone.
Followers who do not overlap. A real person's connections accumulate slowly and overlap heavily with the people they actually know. A cloned account's follower list is usually either near-empty or full of accounts with no relationship to the person's real life.
Contact pushed to another channel immediately. "Message me here instead." Moving you off the platform removes whatever protections and reporting tools exist, and removes the record. Legitimate conversations rarely need to relocate in the first two messages.
Language that does not fit. Not spelling errors — those prove nothing and unfairly flag people writing in a second language. What matters is register: a sibling who suddenly writes like a customer-service script, or a friend who has never once used your full legal name using it now.
Any unexpected request involving money, gift cards, codes, or urgency. Especially a code sent to your phone. A verification code arriving that you did not request means somebody is trying to get into one of your accounts, and anyone asking you to read it out is the person trying.
The signals that mean less than people think
Profile photo quality proves nothing; anyone can take a good photo, and real people use old ones. A small follower count proves nothing. A verification badge proves less than it used to, since on several platforms it is simply purchasable. Account age helps, but plenty of scammers use aged or purchased accounts precisely because people check.
Be sceptical of checklists that promise certainty. What you are doing is accumulating probability, not running a test.
How to check without accusing anyone
The polite and effective move is to verify out of band — through a channel you already trust.
Call the person. Message them on the account you have used for years. Ask them something that a stranger reading their public posts could not answer — not "what's my birthday", which is often public, but something specific and shared: where you last ate together, what you argued about, the name of a colleague.
If someone becomes irritated or evasive when you try to verify, that is information. A real friend will understand entirely, because they have been targeted too.
Never verify by asking the suspicious account to send a photo, including a photo holding a sign. Images can be lifted, edited, or generated, and the request tells the impersonator exactly what will satisfy you.
Reporting a fake account
Reporting works better when the report is specific. Platforms process enormous volumes and a report that clearly states the category and provides the comparison gets actioned faster.
- Choose the impersonation category, not "spam" or "I don't like this". The routing matters — impersonation reports go to reviewers with different tools.
- Link to the authentic account in the report if there is a field for it. Reviewers need something to compare against.
- Capture evidence first. Screenshots including the profile URL or handle, plus the messages. Fake accounts get deleted by their operators once they are noticed, and your evidence goes with them.
- Do not engage. Replying confirms that the account is reaching a real person, which increases its value.
- Warn the people most likely to be targeted — the impersonated person's actual friends and family.
Evidence capture checklist
Before reporting or blocking, save enough detail for a reviewer to find and compare the accounts:
- Record the full profile URL, exact handle (including punctuation), display name, and the date and time you found it. A username can change, so do not rely on a screenshot alone.
- Capture the profile and relevant messages with the account name and surrounding context visible. Save the original files without editing or drawing over them; make a separate redacted copy if you need to share them.
- Preserve message dates, sender details, and the wording of requests. Do not open suspicious links or download attachments just to document them; record the visible URL as text instead.
- Note when and where you reported the account, the category selected, and any confirmation or case number.
- Keep evidence private and limit it to what is relevant. Do not post screenshots publicly or include other people's private information unless the platform or an appropriate authority asks for it.
Escalation path
Match the next step to the harm, and use contact details from an official app or website you navigate to yourself:
- Impersonation without a direct threat: report the profile using the platform's impersonation option, include the authentic account for comparison, and share a brief warning with likely targets over a trusted channel. If available, the person being copied should submit a separate report from their genuine account.
- Money sent or payment details exposed: contact the bank, card issuer, or payment service promptly using its official app or the number on the card. Ask whether a transfer can be stopped, secure affected accounts, and report the fraud to the relevant local consumer-protection or fraud-reporting service. Do not use a phone number or link supplied by the suspicious account.
- A password or verification code was shared: from a trusted device, change the affected password, end unfamiliar sessions, and check recovery details and multi-factor settings. Never send a follow-up code to someone claiming to help.
- Threats, stalking, or exposed location details: preserve the evidence and contact local law enforcement or a specialist support service. If someone faces immediate physical danger, contact local emergency services. Do not confront the account in person.
For what happens after a report is filed, and why review times vary so much, see How content moderation works.
If someone is impersonating you
This is the harder case, and it feels worse, because the harm lands on people who trust you.
Tell your circle first, on the channel they already trust. A short, plain message — there is an account pretending to be me, I will never ask you for money — prevents most of the damage before the platform does anything.
Report from your real account if the platform allows it, since the account you are reporting from strengthens the claim.
Have identification ready. Impersonation appeals often require you to prove which account is authentically you, and having a document to hand shortens the process considerably.
Document everything, dated. If this escalates to harassment, defamation, or fraud against your contacts, a contemporaneous record is what makes police and legal reports actionable.
Tighten what is copyable. Impersonation runs on your public material — profile photos, friend lists, life details. Reducing public exposure will not stop a determined impersonator, but it raises the effort and makes the clone less convincing.
If the impersonation is part of a sustained campaign against you rather than an opportunistic scam, the documentation approach in Responding to online harassment applies.
Talking to family about this
The people most likely to lose money to an impersonated relative are often the least likely to read a guide like this. The useful intervention is not a lecture about scams; it is a single agreed rule, decided in advance:
Any request for money or codes gets verified by phone call, every time, no exceptions, no matter how urgent the message sounds.
Urgency is the whole mechanism. A rule that survives urgency defeats it. There is more on having these conversations without condescension in Helping older relatives stay safe online.