DIGITAL INVESTIGATION
Fake profile: how to find out who is behind it
Fake profiles run scams, defame and threaten in the name of people and companies. Learn the warning signs, how an OSINT investigation reaches the real operator and what to do first.
IN 30 SECONDS
- Don't delete anything or confront the profile: preserve the evidence first.
- Photos, writing patterns, timing and linked accounts often reveal the operator.
- The investigation uses only lawful sources, plus court orders when needed.
- The sooner collection starts, the better the chance of identifying who is responsible.
Fake profiles are used to run scams in the name of people and companies, to defame, threaten and extort. The good news: whoever runs a fake profile almost always leaves traces. With method, those traces lead to the person responsible — and become evidence.
Signs that a profile is fake
- A new account with many followers
Profiles created a few days ago, with bought followers or no real interaction. - Reused photos
Images copied from other people, stock image sites or the genuine profile itself. - Urgency and requests for money
Requests for PIX transfers, “loans” or off-process payments, almost always in a hurry. - A different number or email
The name and photo look right, but the contact is not the one you already knew. - Repeated writing patterns
The same phrases, typos and posting times appear across several profiles — a sign of the same operator.
How the investigation reaches the real operator
- Preserve first
We capture the profile, posts and chats with a record of date, time, URL and hash, before they are deleted. - Map the digital footprint
Photos, usernames, phone numbers, emails and links are searched across open sources, social media and data leaks. - Correlate patterns
Writing style, activity times, linked accounts and metadata are cross-referenced to link profiles to each other and to a person. - Validate with more than one source
A finding only goes into the report once independent sources confirm it. - Report and next steps
The technical report supports formal notices, takedown requests and, when needed, court orders requesting data from platforms.
What we don’t do
We never break into accounts or devices and never use illegal means. The investigation relies on lawfully accessible sources, the evidence the client provides and court orders when identification depends on platform data.
If a fake profile is using your name
- Don’t delete anything and don’t confront the profile: the operator may disappear along with the evidence.
- Take full screenshots with the URL visible, and note the date and time.
- Warn close contacts and customers that a fake profile exists.
- Report the profile on the platform itself.
- File a police report if there is a scam, a threat or defamation.
- Bring in a specialist investigation to preserve the evidence and identify who is responsible.
Quick checklist
- Evidence preserved with date, time and URL
- Contacts and customers warned
- Profile reported to the platform
- Police report filed
- Investigation started before the profile disappears
HOW CiBER DETETiVE CAN HELP
Digital Investigation (OSINT)
Investigation across open sources and the deep and dark web, and de-anonymization of fake profiles, with a technical report.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).