Fake Profile: How to Identify Who Is Behind It, and How to Build an Evidence File

A message from a friend: "Have you seen what they are writing about you?". A profile with your photo and your name, contacting your clients and your family. Or a faceless profile that comments wherever your business is mentioned, and spreads lies. A fake profile can be a nuisance, or it can be a campaign that damages your livelihood and your good name. The difference between the two determines what you should do.

Two types of fake profile

A profile impersonating you

Someone has opened an account with your name and photo, or those of your business. Sometimes to deceive people who know you, for example to ask for money or personal details. Sometimes to publish content in your name that harms you.

A made-up profile attacking you

An account under an invented name, opened to defame, harass or post negative reviews. Sometimes several such profiles act together, and then it is already a coordinated attack.

The first type is usually easier to take down. The second is harder, and usually more damaging.

Signs of a fake profile

• The profile is new, or was dormant for a long time and suddenly came to life.
• Few friends or followers, or friends who also look fake.
• Photos taken from elsewhere: a profile photo of another person, a stock photo, or an image created with artificial intelligence.
• No ordinary activity: no family photos, no events, no comments from friends. Only content related to you.
• Focused activity: the profile comments on only one subject, or only when you or your business are mentioned.
• Familiar phrasing: expressions, spelling mistakes or a style that remind you of someone.

Step 1: document before you report

This is the most common mistake. People report immediately, the profile comes down, and the evidence disappears with it. If you later want to file a claim or a complaint, you will have nothing to show.

What to document:

• Full screenshots of the profile, of every post and comment, including the page address (URL) and the date and time.
• The address of the profile itself, not only the name displayed on it. The name can change, and the address or user ID usually does not.
• Who commented, shared or liked, because that is sometimes where the connections begin.
• Private messages the profile sent to you or to others, with the dates.
• The impact: clients who got in touch, cancelled inquiries, messages from friends. This matters if you later claim damage.

It is also worth saving the pages in a website archiving service, so that there is external evidence that the content was published.

Step 2: report to the social network

All the major social networks have a mechanism for reporting impersonation and harassment. If the profile is impersonating you, choose the option to report impersonation, not just "spam" or "offensive content". You will usually be asked to prove your identity.

If the profile is made up and attacking you, reporting is harder, because it is not impersonating anyone. Here it is worth reporting harassment or a breach of the community rules, and attaching your documentation.

Note: taking the profile down does not guarantee that the harm will stop. Whoever opened it can open a new profile within minutes. When the harm keeps recurring, you need to reach the person behind it.

Step 3: identify who is behind the profile

Why the social network will not tell you

Social networks do not release their users' details on a private request. In Israel, the possibility of compelling a platform by court order to reveal the identity of an anonymous user is limited and legally complex, and the major networks are based abroad in any case. It is a route that is sometimes possible, but it is long, expensive and not guaranteed.

How identification works in practice

Whoever runs a fake profile almost always leaves traces. An investigator working from open sources links them together:

• Photos: where the profile photo was taken from, and whether the published images also appear elsewhere.
• Usernames: people tend to use the same username, or a variation of it, on several platforms.
• Writing style: recurring expressions, consistent spelling mistakes, use of emojis or punctuation. Comparison with the writing of known suspects.
• Hours and patterns of activity: when the profile is active, and whether that matches a particular person's routine.
• Inside knowledge: what the profile knows about you, and who could have known it.
• Connections: who follows the profile, who shares it, and which other profiles act together with it.
• Timing: whether the profile was opened close to a dispute, a dismissal, a divorce or a business rivalry.

Usually, no single detail of this kind proves anything on its own. It is their accumulation that leads to identification.

What you must not do

When someone is harming you, the urge to hit back hard is understandable. But some things may turn you into the party that broke the law:

• Do not try to hack into the profile or into the accounts of the person you suspect.
• Do not send them links designed to reveal their address or to collect information from them without their knowledge.
• Do not impersonate anyone yourself to get them to reveal their identity.
• Do not publish a public accusation against the person you suspect before you have evidence. If you are wrong, you are exposed to a defamation claim.

A licensed private investigator does none of these things either. Evidence obtained this way may be excluded, and may give the other side a defense.

What you can do once you know who is behind the profile

This is a decision best made with a lawyer. The main options:

• A cease and desist letter demanding that the content be removed and the conduct stop.
• A civil claim, for example for defamation or invasion of privacy.
• A police complaint, where there is impersonation intended to defraud, threatening harassment or threats.
• An application for an injunction, where the harm is ongoing.

Whichever route you take, what will decide it is the documentation: what was published, when, what the damage is, and what links the profile to the person.

When you need a private investigator

When reporting did not help, when the profile comes back under another name, when several profiles are acting together, or when the harm reaches your clients and your livelihood. These are signs of a planned attack, not a one-off outburst.

A licensed private investigator documents the content so that it can be presented in court, maps the profiles and the connections between them, and links the traces together until identification. The result is an evidence file on which your lawyer can base a cease and desist letter, a claim or a complaint. In our article on fake reviews, an impersonation profile and a cloned website we explain how such a file is built.

The information in this section is general and is not legal advice. Every case is assessed on its own facts.

In case of any discrepancy, the Hebrew version prevails.