How to find out who is behind a fake account

To find out who is behind a fake account, build links from the account to a known identity using public evidence, and say how strong each link is. Start with what the account shows about itself, then trace what it reused: photos, handles, any email address, phone number or website it published, and sibling accounts from the same campaign. Public evidence can often tie an account to the operator's other accounts and handles with real confidence. Naming the person usually takes the platform, which holds the account's registration and log-in data, or law enforcement where there are threats or extortion.

This piece is for trust and safety, fraud and brand protection teams dealing with impersonation, scam profiles and coordinated fake accounts. It covers each check, what it proves, when to stop, and a worked example. Our guides to linking related accounts, investigating an email address and running an OSINT investigation go deeper on individual steps.

In 2025, nearly 30 percent of people who reported losing money to a scam said it started on social media, with reported losses of $2.1 billion, according to the FTC's April 2026 data spotlight. Scammers, it notes, "might hack into your account to scam your friends or even create entirely fake profiles." Imposter scams were the most reported fraud category that year, and people reported losing nearly $1 billion to business impersonators, the FTC said in June 2026. Meta's August 2026 adversarial threat report adds that scam operators "now increasingly pose as local professionals and trusted community figures".

"Who is behind this account" can mean three questions, and public evidence answers them with falling confidence.

1. Which other accounts does the same operator run? Shared photos, text, domains, creation dates and followers often answer this well.
2. What other names does the operator use? A rare handle or a contact detail reused elsewhere can answer this.
3. Who is the person? That needs a link that does not rest on anything the operator wrote, and public evidence often runs out here.

Most teams need only the first two to act: to report a cluster, warn customers or take down a lookalike domain.

Work passively: read what is public and leave the account alone. Our practice is no messages, no follow or friend requests, no replies, no attempts to trick the operator into revealing something, and no invented accounts used to follow it or win its trust. The Berkeley Protocol on Digital Open Source Investigations, from the UN human rights office and the University of California, Berkeley's Human Rights Center, treats information acquired from internet users "through communication with those users" as closed source. It recommends that investigators view open-source material through virtual identities, so that their real identity stays hidden, and says these should not be used to reach content behind access controls, or "as a pretext to elicit information directly from a person under the pretences of a false identity", which would take the work outside open-source investigation.

Leave password reset and account recovery forms alone too. Using one to glimpse a masked email address or phone number can alert the account holder: Facebook sends a reset email, and its help centre explains what to do about one "that you didn't request". An operator who knows they have been noticed can delete accounts or change handles before you finish.

Save every profile, post and message you rely on with its address and capture time, because a reported account may disappear. If the account is threatening you, the FBI's advice on threats made by message or on social media starts the same way: "Don't delete the messages", record the date, time and sender, "Preserve all electronic evidence", and notify law enforcement.

Some platforms now publish part of an account's history. On Instagram and Threads, About this account shows the date the account joined and how many times its username has changed, "but not the former usernames themselves". For certain accounts it can also show the country the account is based in and "other public accounts that have the most followers in common". On a public X account, About this account opens from the joined date and shows a country or region that X infers itself. Our guide to telling whether a LinkedIn profile is fake covers LinkedIn's equivalent panel.

Those fields describe history, and history can be prepared. Meta's report describes about 575,000 "predominantly dormant accounts mass-produced in Pakistan", which it assesses "were likely warehoused as pre-aged inventory", and a network originating in Russia whose operators "activated dormant Pages" and "renamed them simultaneously just prior to launching their campaigns." An old account with a fresh name and a new purpose may have changed hands.

Then read the rest: where the bio links go and how old the destination is, the first posts from before the account had an audience, the first accounts it followed where the platform shows them, and when and how it posts.

Posting times can hint at where an operator lives, because people sleep. A May 2026 preprint by researchers at Sapienza University of Rome estimated the time zones of Reddit communities from hourly activity alone, assuming activity reaches its minimum "around 4 a.m. local time", and recovered the correct zone "within a one-hour margin on average". The authors stress that their method "makes no claims about the location of individual users". One account gives far less data and a time zone spans many countries, so treat a quiet window as a weak lead.

Writing habits are weaker still on their own. In a 2012 study, researchers at Stanford and Berkeley used writing style to match a sample of three blog posts to the right blog among 100,000 in about 20 percent of cases, and to a different blog by the same author in about 12 percent. Shared spelling and phrasing can support a link that already rests on something specific, and cannot carry one alone.

Run every image the account uses through a reverse image search. A search engine's search by image can return "Websites with the image or a similar image", and Google's About this image panel, available in some regions, can show "When Google may have first seen a similar version of the image" and pages where it appeared "much earlier than other results".

There are three outcomes.

• The photo appears on older pages under another name. The account very likely took it, and the person pictured is usually a victim.
• The photo is a stock image. X's authenticity policy lists "stock, stolen or AI-generated profile photos" among the marks of a fake persona, and a stock match shows the account did not use its own photo.
• Nothing matches. That fits a real person whose photo is not posted elsewhere and a generated face equally well. Meta reports that "synthetic profile photos" remain prevalent in influence operations, and that every coordinated inauthentic behaviour network in its August 2026 report used some form of generative AI it could identify.

A photo is evidence about the account. It says something about the operator only when the same image turns up on other accounts and links them.

Search the handle and display name, exactly and with small variations, on other platforms, forums, code sites, marketplaces and archived pages. A reused handle is worth as much as it is unusual. A 2011 study by researchers at INRIA in France found that predictable usernames are far more likely to be picked by several people, while unusual ones "refer in the vast majority of the cases to unique users." A first name and a birth year link almost nothing, and a long, odd string used for years in one niche links a great deal.

Date every appearance. The Internet Archive's Wayback Machine lets you search archived pages by address and date range, though not every page was captured. A handle on a page from 2021 shows it was in use then, and says nothing about who controls it now.

Handles also move. Researchers at Indiana University's Observatory on Social Media found coordinated accounts on Twitter passing handles among themselves, and noted that "an account changing its handle might be normal, but a group of accounts switching their names in rotation is unlikely to be coincidental." Check that a handle belonged to the same account for the whole period you rely on.

Anything the operator had to set up and control is stronger evidence than anything they could copy: a website in the bio, an email address in a message, a phone number on a landing page, a payment link. ICANN's Lookup tool shows a domain's current registration data, which for a generic domain such as .com includes the date it was registered. A domain created days before the account, with a name that echoes the brand being impersonated, belongs in the file. Our guide to investigating an email address works through what an address can show.

A bio can also carry a real person's name, company or email address, so check that a detail is in use by the operator, in an earlier message or on a page they control, before you lean on it.

Many fake accounts work in groups. Meta defines coordinated inauthentic behaviour as "coordinated networks of Meta assets working together to mislead people using false identities". Look for signs you can see from outside:

• the same images, including cropped or recoloured versions;
• the same bio text, post text or link format;
• creation dates clustered in a short window;
• the same followers, or accounts that follow, like and reply to each other and little else;
• the same destinations, such as domains registered together or pages built from one template.

The Indiana University researchers built coordination networks from traces like these, and their cautions apply to manual work. "Sharing the same image many times is a stronger signal than sharing it just once", shared memes are "not necessarily suspicious if those memes are very popular", and the authors "recommend a manual inspection of the suspicious clusters and their content." Our guide to linking related accounts explains how to weigh each shared value and why two links drawn from one fact count once.

Match the action to the evidence. Several specific, independent links can support a report to the platform, a warning to customers or a complaint to a domain's registrar. A link from that cluster to a named person needs more, because a wrong name lands on someone who did nothing. Public evidence is often enough to show that several accounts share one operator, and rarely enough on its own to say who that operator is.

After the Boston Marathon bombing in April 2013, Reddit's general manager apologised publicly because activity on the site "fueled online witch hunts and dangerous speculation which spiraled into very negative consequences for innocent parties." The post said "let's find out who this is" events "frequently result in witch hunts, often incorrectly identifying innocent suspects".

Write each link with its source, its date and what would make it wrong. The Berkeley Protocol notes that accuracy is often improved through "testing of multiple working hypotheses" and says "Analytical conclusions should not be exaggerated or overstated." Keep a name out of the record unless the decision needs it: the Protocol's data minimisation principle says online content "should only be collected if it is relevant to a particular investigation."

Stop when the next step would need contact with the account, access you do not have, or a guess. The platform can see what you cannot: the details the account was registered with and the record of how it logs in. Instagram's country field, for example, is based on "an account's activity", which only Instagram holds.

Report through the platform's own tools, with your evidence attached.

• Facebook says profiles and Pages that impersonate other people "aren't allowed on Facebook", and you can report one "even if you don't have a Facebook account."
• Instagram lets you report an account in the app for pretending to be you, someone you follow, a public figure or a business. For an account impersonating you, it responds only to reports from that person "or a representative of the person who's being impersonated", with a photo of a government-issued ID.
• X takes reports through its in-app reporting flow, and links a report form for an account "posing as you or your brand."

Bring in law enforcement for threats, extortion and money lost. The FBI says to call 911 if you are in immediate physical danger, and to report "an ongoing crime, threat to life, or national security threat" through its online tip form or a local field office, and points people to local police for incidents below its threshold. Its cyber page asks victims of a "cyber-enabled crime or fraud" to file with its Internet Crime Complaint Center (IC3) "as soon as possible".

The case is a composite. Rathmorrow, Helena Rauchwell and the handle trellisfox are invented, and the domains use the .example names reserved for documentation.

Rathmorrow sells scheduling software to clinics. In September 2026 two customers forward messages from an account using the name and photo of Helena Rauchwell, its head of customer success, offering a discount for renewing early through a billing portal at rathmorrow-billing.example. Rathmorrow's own domain is rathmorrow.example, and it never takes payment through a third party. Its trust and safety lead saves everything with addresses and capture times, and nobody replies to the account.

The account. Its About this account panel shows it joined five weeks earlier and has changed its username twice. Its first posts repost Rathmorrow's announcements, it mostly follows staff at Rathmorrow's customers, and its messages went out between 22:00 and 04:00 Rathmorrow time, a weak hint of a working day several hours ahead.

The photo. A reverse image search finds Helena's real headshot on Rathmorrow's team page, where it has been since 2022.

The domain. A registration lookup shows rathmorrow-billing.example was created two days before the account.

The cluster. The shared-followers panel and a search for the account's bio wording turn up three more accounts, each impersonating a customer success lead at another software company. All were created within the same nine days, each links to its own billing domain registered that week from one page template, and all four are followed by the same 38 recently created accounts that follow little else. These links are specific and independent, so the team rates it very likely that one operator runs all four.

The handle. A customer's screenshot from the account's first week shows an earlier username, trellisfox. That handle has posted since 2021 on a public marketplace forum, selling ready-made business profiles, and one of its posts shows the billing sites' template. The handle is unusual and the template specific, so the team rates it likely that the operator also uses trellisfox. The forum profile gives a first name and a city, and a person with that name lives there, but nothing ties them to the handle except details the operator wrote. The team stops and keeps that person out of the file.

The action. Helena files the impersonation report herself, since a platform may ask the person impersonated for proof of identity, and attaches the evidence. The brand team reports the other three accounts and the domains, alerts the other companies, and emails customers from Rathmorrow's own domain to say staff never take payment through a new portal. One customer had already paid $18,400 through the portal, so it calls its bank and files a complaint with the IC3.

The file states what is established, how strongly, and what is open: who uses trellisfox. The platform, which holds the accounts' registration and log-in data, can go further.

• Bought and prepared accounts. An old creation date can be bought or grown in advance, which is what Meta assesses its 575,000 dormant accounts were likely for.
• Generated personas. A face never posted anywhere leaves image search silent, and Meta describes accounts "featuring AI-generated profile photos and videos of the same fictitious personas", with generated bios and articles to match.
• Separation. An operator who uses a fresh handle, domain, photo and set of followers for every account leaves few links between them.
• Planted leads. A bio can name a real person, a stolen photo shows a real person, and a handle can be borrowed from someone else's old account, each pointing at someone innocent by design.
• Tools. Scheduled posts move posting times, and translation tools flatten style.

The links that hold up best are things the operator had to set up and keep using: domains, templates, long-lived handles and accounts that move together.

Most odd-looking evidence has an ordinary explanation, and a fair review checks it first.

• Stock and shared photos. Many people and businesses use the same stock images, and the person in a stolen photo is a victim. A shared image counts only when it is rare and comes with other links.
• Common names and handles. In the 2020 Census, 2,369,644 people in the US were recorded with the surname Smith, and short handles built from names and years collide constantly. A match needs a second, independent detail.
• Accounts that were taken over. Scammers hack real accounts to scam their owners' friends, as the FTC notes, and the owner of a hijacked account is a victim. When an old account suddenly changes its name, photo or purpose, check for that first.
• Parody and fan accounts. X allows labelled "Parody, Commentary, and Fan (PCF)" accounts that say "parody", "fan" or similar in the name and bio, a different matter from an impersonator.
• Several accounts, one honest person. X lets people operate "up to ten (10) accounts for different, non-duplicative purposes", so one person running several accounts is ordinary.
• Time and language. People travel, work nights and schedule posts, and many write in a second language.

So keep three levels apart. A lead is a reason to look further, a link is a specific, dated connection with a source, and an attribution to a person needs several independent links and usually belongs to the platform or to law enforcement.

Following a handle, a domain and an email address across the open web by hand is slow. Sixtyfour's agent starts from an identifier you already have, such as a handle, a name, an email address, a phone number or a website an account published, researches public sources, links what it finds to the right person or company, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides what to report and to whom. It does not see a platform's account data, so who registered an account and how it logs in stay with the platform. Our investigations page has more.

Build links from the account to an identity one at a time, from what it shows about itself, what it reused, what it published and which accounts it moves with, and rate each link by how specific and independent it is. Work passively, keep the levels of attribution apart, and keep a name out of the record until the evidence for it is strong. When the next step needs contact, access or a guess, hand your evidence to the platform, or to law enforcement if there are threats, extortion or money lost.