Consider an illustrative account with 14,000 followers. The profile photo shows a confident, attractive woman. Posts are frequent, shareable and emotionally charged, and they collect likes quickly. Those surface cues may make the account appear credible, but they do not verify its identity or claims.
It may not be real.
Deceptive accounts are a persistent feature of social platforms. Pseudonymous, private, automated, parody, and organizational accounts are not inherently fraudulent. Distinguish identity misrepresentation, coordinated deception, spam, and account compromise before assigning a label. In its filing for the third quarter of 2017, Facebook estimated that duplicate accounts made up about 10% of its 2.07 billion monthly active users and that false accounts (user-misclassified and undesirable accounts) made up about 2–3% (Facebook 2017 filing). Together, those estimates were widely reported at the time as about 270 million accounts. The historical account estimates and today’s daily-active-people measure use different denominators and definitions, so they are not a trend comparison. Meta now reports a different measure: for the fourth quarter of 2025, after updating its method, it estimated that less than 5% of its worldwide daily active people consisted solely of violating accounts, a category that includes bots and spam (Meta 2025 annual report).
Fake accounts have also been used in state influence operations. In September 2017 Facebook disclosed about $100,000 in ad spending, on roughly 3,000 ads between June 2015 and May 2017, connected to about 470 inauthentic accounts and Pages (Facebook influence operations disclosure). The U.S. Senate Intelligence Committee later reported that one of the Internet Research Agency’s top-performing Facebook pages, “Blacktivist”, generated 11.2 million engagements with Facebook users (Senate social media report).
For researchers, journalists, investigators and decision-makers who rely on social media data, an account that is not what it seems can distort a dataset, a source list or a finding. This guide explains why fake accounts exist, sets out seven observable signals, assesses what AI tools add, covers the legal and ethical limits of facial recognition, and ends with a six-step verification workflow. It is AOFIRS’s main guide to fake accounts. For website-level investigation, see the fake website verification guide. Commercial fake engagement has additional legal considerations, discussed below.
Why Fake Accounts Exist
People who run fake accounts usually have a clear purpose, most often money or influence. Three common motives are outlined below; they are not an exhaustive classification.
Influence operations
Influence operations use fake accounts to manufacture the appearance of consensus: making fringe positions look mainstream, amplifying narratives that suit a government or organization, or suppressing legitimate discussion through coordinated mass reporting of authentic accounts. Platforms prohibit this. X bans coordinated activity that artificially influences conversations through multiple, fake or automated accounts (X platform manipulation policy), and TikTok prohibits covert influence operations that mislead its systems about an account’s identity, origin or purpose (TikTok authenticity policy).
Commercial fraud
Account and page owners buy fake likes and followers to look more popular, because platform ranking systems and advertisers both reward apparent engagement. Accounts and pages with large inflated audiences can then be sold to businesses that want a ready-made following. The FTC rule addresses specified knowing sales and purchases of fake social influence used to misrepresent influence or importance for commercial purposes; it does not prohibit every automated account or every purchase of legitimate advertising.
Spam, scams and phishing
Spam and phishing operations use fake accounts as delivery vehicles. Once an account has an apparently real history, it can carry malicious links, fraudulent investment schemes or credential-harvesting attempts. In the FTC’s data for fiscal year 2025, social media was the top contact method by reported losses, with consumers reporting more than $2 billion lost to scams that began there (FTC social scam testimony).
Fake engagement is produced in four main ways: click farms, where people are paid to like or follow by hand; purpose-built fake accounts created only to inflate metrics; automated accounts run by scripts; and real accounts that have been hijacked or infected with malware and engage without the owner’s knowledge. The FTC’s legal definition of fake indicators of social media influence covers the same ground, naming bots, accounts not associated with a real individual, accounts created with a person’s information without consent, and hijacked accounts (FTC fake influence definitions).
How a Fake Account Is Built
Deceptive accounts can combine stolen or synthetic images, invented biographical claims, recycled content, purchased engagement, or compromised legitimate accounts. The pattern below is illustrative, not a universal creation sequence.
One possible pattern starts with an invented identity and a fabricated biography. Attractiveness, gender, or the use of prepaid or virtual phone services is not itself evidence of deception. The profile picture is a stock photo, an image taken from another person’s profile or, increasingly, an AI-generated face. People cannot reliably tell such faces from real photographs and tend to rate them as more trustworthy (Synthetic face perception study).
The account then builds a posting history from shareable, emotionally resonant material, such as mildly viral images and opinion-triggering posts designed to provoke reactions rather than inform. It shares these into large, active groups and communities so that the content reaches real users’ feeds. Real users engage, and the engagement spreads.
Some operators also purchase engagement or transfer accounts to new users. A posting-history change can therefore warrant investigation, but a large audience alone does not establish manipulation.
Seven Signals That an Account May Be Fake
An initial assessment needs no specialist software. No single signal proves that an account is fake; several together justify the deeper checks in the workflow below.
Profile Photo Inconsistencies
Run the profile photo through at least two reverse image search engines, such as Google Lens, TinEye or Bing Visual Search. Fake accounts often use stock photos or images taken from other profiles. If the same image appears on a modeling website, a foreign-language social network or an unrelated profile under another name, investigate the original publication and the identity claim. Reuse may reflect a pseudonym, licensed image, cross-posting, or impersonation; a foreign-language match is not inherently suspicious. A missing match does not prove the image is genuine or AI-generated. Use image artifacts as weak leads and corroborate identity through independent public evidence. Face-search engines are a separate category with legal implications, covered below.
Account Creation Date vs. Follower Velocity
There is no universal timetable for gaining followers. A new account can grow quickly after viral coverage, migration, advertising, or an established person’s launch. Rapid growth combined with unexplained behavioral inconsistencies warrants checking, but numerical thresholds alone do not establish purchased engagement. Where the platform shows it, also check the join date and any record of username changes.
Follower-to-Following Ratio Anomalies
Fake accounts often follow large numbers of users indiscriminately in the hope of follow-backs, which produces a following count far above the follower count, or show thousands of followers while following almost no one and posting little. These patterns also occur in legitimate news, celebrity, organizational, new, and private accounts. Compare like-for-like accounts and investigate the context.
Engagement Rate Mismatch
An account with 50,000 followers whose posts consistently receive only 12 likes and two comments has an engagement rate of about 0.03% (14 interactions divided by 50,000 followers). Typical rates vary by platform, niche and account size, so compare the account with several similar ones rather than with a single benchmark. Likes from click farms rarely come with genuine conversation, so also check whether comments are specific to the post or generic.
Content Originality Deficit
Some deceptive accounts rely on reposted material, but legitimate curators and organizations do too. Conversely, original-looking material can be fabricated. Assess whether the account has produced content whose provenance and context can be checked independently, such as a photo taken at a particular location, a perspective on a personal experience, or commentary demonstrating domain expertise.
Network Quality
Analyze the account’s followers by sampling 20 to 30 profiles. If these followers exhibit similar characteristics, such as incomplete profiles, clustered creation dates, or shared posting behavior, record the pattern as a lead. A convenience sample can be biased and cannot establish coordination or estimate an account’s fake-follower percentage. Shared public interests or events can also explain similarities.
Profile Completeness and Consistency
Incomplete biographies and absent work or school details are normal privacy choices. Focus on material contradictions in affirmative claims, such as an alleged professional role that conflicts with an official public directory. Missing search results or changing locations are not proof of a fabricated identity.
What the Platforms Are Doing, and Their Limits
Platforms remove fake accounts in large numbers and increasingly identify them by behavior rather than content: identical posts repeated across accounts, sudden spikes in activity, and coordinated timing that suggests automation or central control. Meta’s annual report describes sampling accounts and reviewing them for signs that they are inauthentic as part of estimating how many violating accounts it has (Meta 2025 annual report).
Some features that older guides recommend no longer exist. Facebook shut down its Face Recognition system in November 2021 and with it the automatic alerts that told users when they appeared in photos or videos posted by others (Meta face recognition update). Advice built around “EdgeRank”, an early name for Facebook’s feed-ranking formula, is also out of date and should not be relied on.
Platform countermeasures include preventive and reactive measures, and their coverage is incomplete. The World Economic Forum’s Global Risks Report 2026 ranks misinformation and disinformation second among global risks over a two-year horizon and fourth over ten years (Global Risks Report 2026). Automated publishing is growing too: NewsGuard had identified 3,749 AI content farm news and information sites in 16 languages by its update of June 23, 2026 (NewsGuard AI tracking center).
Research on bot detection describes an ongoing challenge in which detectors and operators adapt (Social bot detection review). Estimates of scale are dated and depend on method. One widely cited study estimated that between 9% and 15% of active Twitter accounts were bots in 2017 (Twitter bot estimate study); treat such figures as snapshots, not current measurements.
AI-Assisted Verification: What It Adds
AI tools speed up parts of verification for individual researchers and organizations. They do not replace judgment, and each type has limits.
Reverse image and face search
General reverse image search finds where the same picture appears online. Face-search engines such as PimEyes go further: they compare a face across different photographs, which can surface other images of the same person. That makes them powerful and legally risky. Read the next section before using one.
Geolocation intelligence
Researchers can test whether an account’s claimed location matches its photos by comparing landmarks, architecture, signage, vegetation and shadows against maps and street-level imagery. Some AI tools now suggest likely locations from these visual cues without relying on embedded metadata. Treat their suggestions as leads and confirm them against reference imagery before relying on them.
Behavioral pattern analysis
Social-listening and network-analysis platforms map relationships between accounts and flag bursts of coordinated activity across many sources. They are most useful for spotting patterns that are invisible on a single profile, such as dozens of accounts posting the same link within minutes. They are commercial products whose coverage and methods vary, and their outputs need the same checks as any other evidence.
Natural language processing
Natural language processing can flag linguistic markers associated with automated or coordinated content: unusual syntactic patterns, improbably consistent vocabulary across posts, the same phrasing shared by many accounts, or an emotional register that seems calibrated rather than spontaneous. Individually these signals are inconclusive; even in combination they require contextual checks, since shared campaigns, translation, templates, and group norms can produce similar language.
Human oversight remains essential. Machine-learning classifiers can perform well on the datasets they were trained on, but real-world accounts are messier and operators adapt to known detectors (Social bot detection review). Professional researchers treat AI outputs as leads or model scores, not conclusions. Do not interpret a score as a calibrated probability unless its validation supports that use.
Facial Recognition: Legal and Ethical Limits
Face-search tools process biometric data, which many jurisdictions protect more strictly than other personal information. Under the EU General Data Protection Regulation, biometric data processed to uniquely identify a person is one of the special categories whose processing is prohibited unless a specific exception applies (GDPR Article 9). In Canada, federal and provincial privacy commissioners found in 2021 that Clearview AI’s collection of facial images from the internet without consent amounted to mass surveillance and broke Canadian privacy law. They also found that images scraped from social media were not covered by the exception for publicly available information (Canadian Clearview investigation).
PimEyes is itself the subject of legal dispute in Europe. In an April 2026 announcement, updated in July, the privacy organization noyb described litigation against the Hamburg data protection authority over its handling of a complaint filed in 2020. The complaint alleges unlawful biometric processing; the organization’s announcement is not a final judicial determination (noyb PimEyes litigation update).
For researchers, practical rules follow:
- Start with the least intrusive method suitable for the task. Ordinary reverse image search compares an image and its variants rather than seeking all images of a face. Uploading an image still discloses it to a service; check authorization, terms, retention, and privacy before submitting personal material.
- Use face search only for a documented, lawful purpose. Check the law where you and the subject are located, and your organization’s policy; many prohibit face search on private individuals.
- Never identify a private person from a face match alone. Matches can be wrong. Corroborate any identification with independent evidence before acting on it or publishing it.
- Keep a record. Note what you searched, why and when, and store the results securely.
A Practical Six-Step Verification Workflow
The following practical framework provides a repeatable, documented process for assessing an account’s specific identity and behavior claims. It is a research workflow, not a validated diagnostic test or a guarantee of authenticity.
- Profile audit: Document the account’s creation date, follower and following counts, posting frequency, content types and bio completeness. Note any inconsistencies between claimed attributes and observable behavior. Capture dated screenshots or archived copies.
- Reverse image search: Submit the profile and cover photos to at least two reverse image search engines, such as Google Lens and TinEye. Document the results. Any match to an unrelated source warrants deeper verification.
- Network analysis: Where publicly available and proportionate, start with a documented sample of 25 followers and 25 followed accounts. State how you selected them; this is exploratory sampling, not a representative prevalence estimate. Document their creation dates, completeness and engagement patterns, and identify clusters that share creation-date ranges, posting behavior or profile structure.
- Engagement audit: Calculate the engagement rate (total interactions on each recent post divided by follower count, averaged across posts) and compare it with similar accounts. Check whether comments are substantive or generic, and whether the commenting accounts pass their own quick check.
- Cross-platform identity check: Search for the account’s claimed name, profile photo, username and stated attributes on other platforms. People may intentionally use different names, images, and privacy settings across platforms. Link accounts only when corroborating evidence supports the connection, and avoid publishing private identities unnecessarily.
- Specialist verification for high-stakes cases: Where the stakes justify it, use specialist tools: username and email search services to map linked accounts, network-analysis platforms for coordinated behavior, and deepfake-detection services for video. Observe the facial-recognition limits above, document every tool and its output, and keep an audit trail for the research record.
Conclusion: The Researcher’s Obligation
Fake accounts are not only a platform or political problem. They undermine the reliability of every dataset, sentiment analysis and trend report built from social media.
For professional internet researchers, telling authentic signals from manufactured ones is part of the job. The methods now available, from simple reverse image searches to AI-assisted behavioral analysis, make systematic verification achievable. Professional judgment remains essential, because a convincing account is not necessarily a genuine one.
Convincing accounts can survive a casual look. Record observed facts, uncertainties, alternative explanations, sources, and the date of each check. Conclude “unverified” when the evidence is insufficient; do not publicly accuse or identify a person on the basis of a heuristic or automated score.
References
- Cresci, S. (2020). A decade of social bot detection. Communications of the ACM, 63(10), 72–83. Social bot detection review.
- Facebook, Inc. (2017). Form 10-Q for the quarterly period ended September 30, 2017. U.S. Securities and Exchange Commission. Facebook 2017 filing.
- Federal Trade Commission. (2026, March 25). Prepared statement of the Federal Trade Commission [Testimony of L. Greisman before the U.S. Congress Joint Economic Committee]. FTC social scam testimony.
- Meta Platforms, Inc. (2026). Form 10-K for the fiscal year ended December 31, 2025. U.S. Securities and Exchange Commission. Meta 2025 annual report.
- NewsGuard. (2026, June 23). AI tracking center [Last updated]. NewsGuard AI tracking center.
- Nightingale, S. J., & Farid, H. (2022). AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, 119(8), e2120481119. Synthetic face perception study.
- noyb. (2026, April 30). No action taken against PimEyes: noyb lawsuit against Hamburg DPA (updated July 8, 2026). noyb PimEyes litigation update.
- Office of the Privacy Commissioner of Canada. (2021, February 2). Joint investigation of Clearview AI, Inc. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information and Privacy Commissioner of Alberta (PIPEDA Findings #2021-001). Canadian Clearview investigation.
- Pesenti, J. (2021, November 2). An update on our use of face recognition. Meta. Meta face recognition update.
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), art. 9. (2016). Official Journal of the European Union, L 119. GDPR Article 9.
- Stamos, A. (2017, September 6). An update on information operations on Facebook. Facebook. Facebook influence operations disclosure.
- TikTok. Integrity and authenticity. Community Guidelines. Retrieved November 4, 2026, from TikTok authenticity policy.
- Trade Regulation Rule on the Use of Consumer Reviews and Testimonials: Definitions, 16 C.F.R. § 465.1 (2024). FTC fake influence definitions.
- U.S. Senate Select Committee on Intelligence. (2019). Report on Russian active measures campaigns and interference in the 2016 U.S. election, Volume 2: Russia’s use of social media with additional views (116th Congress, 1st Session). Senate social media report.
- Varol, O., Ferrara, E., Davis, C. A., Menczer, F., & Flammini, A. (2017). Online human-bot interactions: Detection, estimation, and characterization (arXiv:1703.03107). Proceedings of the International AAAI Conference on Web and Social Media. Twitter bot estimate study.
- World Economic Forum. (2026). Global risks report 2026: Chapter 1. Global Risks Report 2026.
- X Corp. Platform manipulation and spam policy. X Help Center. Retrieved November 4, 2026, from X platform manipulation policy.
