Identifying Who’s Behind a Twitter Fake

Some years ago I began to take an increasing interest in a couple of guys who were experts at identifying fake Internet accounts. They weren’t trained specialists – they were just ordinary Web users. But they were always exposing fake accounts, and they were always right.

On one occasion, one of them uncovered three digits’ worth of accounts belonging to the same person, and published his allegations. Initially, to say I was sceptical was an understatement, but it soon became clear that his accusations were correct. I became fascinated with how he investigated these matters – all the more so because he’d often publish his rationale and evidence in each case.

Subsequently, I began to concentrate on Twitter, where I found other people with an incredible nose for fake accounts. One or two of them could not only identify fakes with 100% accuracy and no false positives – but also quite regularly establish the identity of the real person behind the fake. Once I saw that, I was hooked.

By this time, I knew about some of the discovery techniques which could be used to identify catfish. Google Images Reverse Search could often reveal a stolen profile picture and point to its real source. Twitter’s Advanced Search commands could recover obscure information that everyone thought was lost. And psychology could help work out who might have the motivation to create a specific fake profile.

But it was still hard to see how an ordinary person with no unusual contacts or hacking abilities, could so quickly source the real identity of a Twitter fake. What I could see, was that finding out the real identity of an online catfish, had a very high success rate in shutting down their campaigns – once and for all.

SO HOW DO TWITTER FAKES GET CAUGHT AND IDENTIFIED?

One of the biggest giveaways of fakes and catfish is that they can’t hide their self-interest. A fake’s self-interest is the reason they do what they do, and it’s therefore going to be writ large across every account they own. It has to be. Otherwise there’d be no point in them creating fake profiles.

Unusual behavioural traits, coupled with other identifiers like rare spelling mistakes and creation-time characteristics (more of which later), will typically make it obvious that two separate Twitter profiles are run by the same person. You can even double-check they belong to a common user by baiting the two accounts with an IP Logger link, which will record their IP addresses. But how do you find the two accounts to compare in the first place? Is it possible to unearth ALL of a catfish’s Twitter accounts?

THE WEB OF DECEIT

It’s not really in a fake’s nature to have just one online account. They’ll almost inevitably have a range of Twitter profiles on the go at any one time. Why? Because they know how vulnerable they are to being caught, and they need ways to convince people that their profiles are real. The way catfish convince people is generally by setting up more profiles and interacting with themselves. Not just talking to themselves, but following themselves. Sometimes Liking and Retweeting their own tweets. This self-interaction makes their profiles look credible. It’s like:

“Hey, if other users believe this profile is real, then it must be legit.”

But the web of deceit which is meant to assure the fake’s success, so often proves to be their downfall. It can give their game away, and worse, lead to every component in their ruse being discovered – including their own, personal account, which reveals their real identity.

SUPPORTIVE ACCOUNTS

So, these shill or supportive accounts. The additional profiles created by fakes to convince the public that everything’s above board. How do you find and identify them?

Networks of Twitter accounts can act like groups of hyperlinks, all pointing at one specific hub. They may not all reply to each other, and the most nefarious account will of course be deliberately isolated from any indication of a real identity. But the supportive accounts link everything together. If you’re a fake, then once someone starts to identify those supportive accounts as being yours, you’re in massive trouble.

HOW TO START LOOKING FOR SUPPORTIVE ACCOUNTS?

Begin searching for these shills by checking the Likes, Retweets and Replies on a suspected fake account’s tweets. Who’s interacting? If you don’t know who the responses are from, individually check out the interacting accounts. Remember, some of these accounts may well belong to the fake himself.

You may instantly notice odd things about the accounts interacting with your suspected fake. Sometimes, literally everything on a supportive account’s page will relate to the suspected fake’s profile. The page solely comprises retweets of the suspected fake’s tweets, and replies to the suspected fake. Or at least, there’s an unfeasibly high incidence of support for the fake.

People use social media for their own gain, so if you see an account that’s focused entirely on someone else, you need to run a reality check.

If you see no tweets on the pages of the interacting accounts, dig deeper. Check the Likes list. With a fake’s shill and supportive accounts, the Likes list may be dedicated almost totally to self-applause. This is not easy to spot from the main catfish profile, but it’s immediately apparent once you check from the other end – within the individual Likes lists of the interacting accounts.

FAKES FOLLOW THEMSELVES

Following on Twitter is kind of silent. It’s not like the fanfare of conversation. Fakes know that if they follow their own accounts with shills and supportive profiles, it’s incredibly unlikely that anyone will notice. Catfish have strong motivation to follow their own accounts, because some of their less visible profiles don’t attract real followers, and that would otherwise look suspicious or unconvincing.

So once you feel you’ve found a shill or supportive account created by the fake, have a look through the Following and Followers lists. Because supportive/convincer accounts are usually small, their Follower/Following lists are typically short. Bearing in mind the fake’s temptation to follow himself, look very carefully at what you find in these Follow lists.

Additional Tip 1: Use Tweepi to go right to the very start of the main catfish account’s Follow and Friends lists and check out the first few instances of follow activity. When people follow themselves, they typically do it very early on, so the initial follows are highly worthy of attention.

Additional Tip 2: Use Twitter’s Advanced Search to check the very first @mentions a suspected fake received. There’s info on date-sensitive searching in the Old Usernames post. Again, the earliest mentions are particularly likely to come from the same person’s alt accounts. Indeed, a search of anyone’s first ten or twenty tweets very often reveals some very interesting information, which everyone thought was long buried.

THE FAKE’S PERSONAL ACCOUNT

The dark recesses of a supportive account’s follow lists are a place where a fake feels pretty safe. He doesn’t think you’re going to look through the follow lists of accounts that barely do anything. Therefore, he may be careless enough to commit that one fatal mistake: connect in some way with his ‘personal’ Twitter. The one that references his real identity.

If you do find a fake’s personal Twitter profile, you’ve probably struck gold. Getting this far is a skill, and you often have to be detective-minded to recognise the spiral of self-interest that gives the association away. For someone experienced in studying fakes, the personal profile will probably stand out in the backwater of largely inactive supportive accounts. The activity looks real. The interaction is varied, the Follow lists look genuine and are not made up solely of empty husks. There’s just something that jumps out and says: “Whoa! this looks like the one.”

Once you’ve hit that jackpot, or think you have, standard practice is to use Twitter’s Advanced Search to rifle the personal account for major Internet keywords. “Facebook”. That’s always a good starter. People link to their own pages online. So search for “Facebook”, and see if the ‘personal’ Twitter account links to it. Search for the names of any sites where you feel the catfish might be tempted to post more details about themselves. Reverse search the images you find in the personal Twitter – find out where else they appear. Do they show up on a dating site, for example?

It’s often amazing how much personal information people give away online. Fakes try to compartmentalise everything so their different identities stay detached. But a good Twitter detective will piece together the jigsaw. Even if a fake’s ‘personal’ Twitter account doesn’t officially carry their real name (and most don’t, in my experience), the individual may have used the personal account’s alias elsewhere – including in places where they’re much more likely to say who they really are. This can be useful if you find no links to Facebook and the like in the tweet content.

I remember putting one alias into Google, and finding the guy had used it on a mind-boggling array of sites. If you’d heard of the site, he was on it. Within five minutes I knew his full name, where he worked, where he lived, his background… Looking from the other side, you’d never have believed what he was up to on his anonymous Twitter accounts. Then I found his Tumblr… Oh. My. God. Weirdest. Page. Ever.

WHAT TO LOOK OUT FOR – IN SUMMARY

Studying fakes on Twitter is not a simple task. The key point to keep in mind is that (celeb worship and sexual motivation aside) no social media user will run around persistently applauding, promoting and/or defending another random individual. It just doesn’t happen. If you can’t explain an instance of selflessness, you’re almost certainly witnessing selfishness. Two accounts, one slavishly serving the other = one person, sneakily serving themselves.

Reality-check everything with the above in mind.

Look for small, inconsequential and often extensively dormant Twitter accounts which connect in some way with a suspected catfish. These supportive accounts may have connections with a ‘personal’ Twitter profile, which references the fake’s real identity.

In brief, supportive accounts will often…

Reference the main account(s) in an unrealistically biased or disproportionately intensive manner.

Defend the main account(s).

Follow very similar or exactly the same people, and follow the main account(s) very early on in their follow list.

Follow each other.

Have a low follower count, so the fact they’re following each other is easy to spot.

Consistently use the site at the same times as the main account(s).

Primarily comprise Retweets.

Use profile pics that are either: stolen facial portraits which can be traced via Reverse Image Search, or random images which don’t feature a person, or just the default egg.

Mirror each other (and maybe the main account) in creation-time characteristics. This is stuff like the style and wording of the bio, how much information is enterted, what the demeanour of the user is, and whether the theme is customised. Demeanour is often the ‘dealbreaker’. People can type different words, but they can’t really change their personality, needs, whims and goals. Even the format of the name and username can provide hints. Some people never use capitals, others add numbers to the usernames, etc.

Use a common source for their image content.

The list goes on. Supportive accounts can often be almost invisible, because they’re only used when they’re needed, they don’t typically build up big follower counts, and usually they barely post any content of their own. But the very things that make them almost invisible, also make them easy to identify as supportive accounts once they do come to light.

OTHER INDICATORS

Issues such as spelling, grammar, punctuation (or the lack of it), catchphrasing, strange or unique hashtagging, odd formatting, and (especially) unusual motivations will help identify other accounts run by the fake. The beauty of this is that most people think their conduct is perfectly normal and so are not aware that they’re leaving any clues.

Fakes commonly have weird motivations and in connection with that, exhibit weird behaviour. It doesn’t seem weird to them, but for perceptive onlookers it appears almost like a branding.

Some fakes return after suspension and are surprised when within five minutes people are calling them by their old username. No one else has the same psychological fingerprint.

CONCLUSION

The motivation encapsulated in that psychological fingerprint is the reason the fake became a fake, and there’ll always be a reason. That motivation will also show up in the behaviour of the same person’s other accounts, albeit probably in a more suppressed form. If you’re perceptive and have empathy, motivation is the easiest way to identify fakes across multiple accounts. It universally controls everything the fake does.

Some fakes are pretty well organised, but even the best organised people in the world are subject to the human condition. The best analogy I can come up with is that being a fake on Twitter is like disguising yourself as the guy from five doors down the road to paint your own garden fence. You look like the other guy, but everyone knows it’s you, because it’s your garden fence you’re painting. Why would the guy from five doors down paint your garden fence? Answer: he wouldn’t. So who’s the obvious suspect? Yep, it’s you.

This post was last updated in July 2016.

Into Twitter forensic hacks? Don’t miss How to Find Out WHEN Someone Followed You on Twitter.

Twirpz

Inside the Social Web

Share this:

Related

Inside the Social Web