Before you read this piece: Looking for something you can do to combat American-aimed fake news and lies? Check out this article that features a strategy for talking to people on Facebook about fake news.
I?ve spent a good amount of time studying Facebook accounts and identifying those that are fake or deceptive (specifically Facebook accounts impersonating U.S. citizens). My work on Facebook accounts has been featured in the NY Times and the Washington Post.
These fake Facebook accounts imitate all kinds of people, including conservatives, liberals, native Americans, and Muslims, and do so for all kinds of reasons; this is not a partisan or politically-one-sided problem.
In this piece, I?ll give some do-it-yourself tips for spotting fake Facebook accounts. The goal of this piece is to make more people realize how extensive this problem is, to get more people to report fake accounts, and to make people more skeptical about online accounts and websites. There?s also the hope that more public concern about this problem will lead to Facebook taking the problem more seriously.
For this piece, I got help from Sarah Thompson, the creator of a blog called Exploiting The Niche and an associated Facebook page; Thompson works exposing assorted scams and fake accounts on Facebook.
The tips below are mostly about finding several clues that point toward an account being fake. While there are a few standalone clues that will make it very likely an account is fake (like finding the real person from which they?ve stolen the picture), mostly it?s about putting several clues together that, taken together, make fakeness very likely.
Clue #1: Sharing of low-quality, ad-heavy websites
The goal of many fake accounts is to get you to go to a specific website. On that website are a lot of ads, and the website owner makes money from advertisers by showing how many visitors they had on their site viewing those ads.
So the strategy of many fake accounts is to post links to these websites in popular Facebook groups, where they?ll get a lot of clicks. Sometimes a longer-term strategy is to get you to follow/Like a Facebook group in the hopes you?ll click its websites links later.
An account that shares low-quality or fake news sites is not a sure-fire sign an account is fake; many real people share these sites. But an account that frequently shares low-quality sites can be a good initial sign of fakeness.
To see what an account has been posting publicly in groups: 1) on the Facebook search page, under ?Posted by?, select ?choose a source? and enter the suspect account?s name, 2) there will probably be multiple accounts with that name, so try to find the image matching the suspect account. For many fake accounts, you?ll see that they?ve made many posts of low-quality sites to Facebook groups in specific niches.
You could write a lot about how to recognize spammy/shady websites, but a few major clues are: 1) a large amount of ads, 2) bad and awkward language use, 3) no About/Contact info, 4) no author listed or an author that, when researched online, seems fictional.
This fake news website was posted by a fake account in a Facebook group. This is what you see when you first click the link; you have to scroll down past many ads to even see the story you clicked on.
Also: some fake accounts don?t seem interested in clicks/income and will post content not associated with websites or links. This is one clue that some of these fake accounts are engaging in propaganda efforts and not just money-making.
Clue #2: Different name in URL
A lot of fake accounts, not all, will have a different name displayed in the URL than shown in the display. This happens for accounts that used to be owned by a real person that was hacked, or for fake accounts that were used for a different purpose at one point (for example, switching from Middle-Eastern-aimed content to American-aimed content).
Here?s one example of a URL different from the displayed name of ?Isabelle Jaden.? This was an account with a female?s photo and a location of Peoria, Illinois.
Facebook users can change the displayed profile in Settings; this name conflict just sloppiness on the part of fake account creators. Since outing fake accounts out many times in Facebook groups, I?ve noticed less of these more-obvious indicators. Unsurprisingly these guys are becoming better and more careful.
Note: this isn?t always a clearcut indicator. Some people change their displayed name for various reasons, like for privacy concerns. But the more extreme the disconnect is between the URL and displayed name, the more meaningful it is.
Clue #3: Content shift or content disconnect
A lot of fake accounts will go from being used one way to being used another way. For example: a hacked middle-Eastern account goes from posting Pakistani dance videos and memes in Urdu for years and then, at some point in 2017, uploads a white person?s picture and starts posting U.S.-aimed political content (either on their own wall or in Facebook groups).
This general pattern can be noticed in various ways and in various sections of a Facebook account. Here?s a few places you might notice it:
- The feed. Scroll back through the feed to see what you can see. You might see an obvious shift in content, maybe accompanied by the spot where a new profile pic was uploaded. You might see the language used shift. Use the shortcut year selector at the top of the page, which lets you jump to a much earlier year. Many fake accounts will have been created very recently, so a short, seemingly-recently-created feed is one clue of fakeness (more on that in a second).
- Friends list. Click on the friends list and look for an unusual number of ethnic names that conflict with what you?d expect that account to have. For example, a Texas conservative with a Friends list of almost all middle-Eastern-sounding names.
- Groups, Likes, Check-ins, etc. Click the More? button to look at these different sections. Make sure you scroll all the way to the bottom of each one, as they (at least currently) are in chronological order. So, for example, you might check out the Likes of an account (Facebook pages they?ve liked) and see recent U.S.-related Likes and then, towards the bottom, see a bunch of Macedonian-related Likes.
- Post likes and reactions. Look at who has Liked an account?s earliest posts and pictures and see if the ethnicity of the names jibes with the current nature of the account. Note: anyone can comment on public posts so unexpected types of names on public posts isn?t a clearcut indicator; it?s just another clue.
This is from a fake-American account that posted an anti-Trump post in a Facebook group called ?I Hate Donald Trump.? Scrolling back in his feed you see his earliest posts are Liked by people with Middle-Eastern names.
Clue #4: Lack of content, pics, interactions
If you spend a little time perusing the Facebook accounts of strangers (non-friends), you?ll find that most accounts will have some content visible. They may have certain sections or aspects locked down privately, but there will usually be some things that give credence to the fact that they?re real people. For example, many accounts will have: a) some publicly-visible photos with natural, organic-seeming comments and interactions, b) a diverse amount of content posted in their feed (i.e., not all on the same topic), c) some Friends visible, d) several profile pics publicly visible from over a decent span of time.
All of these things are pretty common for most accounts, even very private ones, and spotting an account that has almost no personal pics, or zero personal pics, or no comments on their posts despite a good amount of posts, can be an initial indicator that something is strange. Of course none of these are ironclad proof, but it can encourage you to dig a little more, whereas if you saw a lot of personal pics and seemingly organic interactions from their Friends on them, you might decide the account checks out.
(One note here: lack of content/interaction is more suspicious for younger-age accounts than for older accounts; older people may just not be active on Facebook, but this holds less true for younger people. At the same time, older people are less savvy about privacy settings and often have a lot of their content and activity public, so the general rules are still generally true for them assuming they are somewhat active on Facebook.)
Also, many fake accounts will have been recently created. If you see that there?s only one personal pic publicly visible and it was the first publicly-visible thing posted just a few weeks ago, that?s suspicious. Many fake accounts have no personal pics visible. Most will use one or two they pulled from somewhere else, just enough to pass muster at a quick glance.
This was the first public post of this account, just 6 months ago: a generic picture of a car. And the profile picture is of Marilyn Monroe. And there is only a single like on this photo (along with hardly any interaction on her other posted content).
Clue #5: Patterns in profile details
Most fake account creators are lazy. Most are going for quantity over quality. This means there are often patterns to what they put in bios. Here are some of the more common patterns:
Well-known city or state names used in profile info. For example, a profile might have:
Teacher at New York UniversityLives in New York, New YorkFrom New York, New York
Fake account creators often use common, well-known place names, probably because the account creators are more likely to be familiar with those names. They?ll search Facebook for these place names (New York, Miami, Texas, for example) to find a location where their fake account lives or has a job. These aren?t usually strong indicators, but it can be an initial indicator that an account seems unusually generic or unlikely.
Sometimes they will use commonly known or popular companies or schools and these can be at odds with other details about the person. An example: one fake Trump-supporting account had these details: ?Graduated from Harvard University 2015? and ?Works at CNN.? Of course, it?s possible someone would have all three of these traits, but it?s clearly very unlikely.
Note the generic-sounding ?Florida Hospital.? Most fake accounts will choose work/school/location details with popular and well-known location/city names.
Clue #6: Use of other people?s photos and names
If fake accounts want to appear legit, they have to get their photos from somewhere. Sometimes they will use actor/performer photos, either well-known celebrities or lesser-known, hard-to-recognize actors. Sometimes they will pull pictures from random sites, like company employee pages or outdoor event websites. (It?s been suggested that some more strategic accounts may upload old family photos found at thrift shops and estate sales.) There are obviously many, many places to find photos.
One of the more surprising things I?ve seen from fake accounts was a network of interconnected fake pro-Trump accounts that almost all used the names AND pictures of real people on Facebook. That may seem a surprising strategy as you?d think that would obviously make them more likely to be caught. Some fake accounts that use this strategy may block the real person they?re imitating, so as not to be found by that person (although the network I found had apparently not blocked most of the real people). (And this strategy being used means we should all occasionally search for our names on Facebook and in search engines to make sure no one is using our name and/or likeness.)
Ways to research these things include:
- Download or take a cropped screenshot of an account?s more distinctive personal pics and then use Google Image Search to search for those images. I?ve discovered the real people whose pics were used by fake accounts several times this way.
- Search Facebook for that same name. Sometimes you will find several fake accounts with the same name and even the same pics.
Harry Taylor apparently a popular choice when creating fake accounts. Note how they didn?t even bother changing the location or the picture.
Clue #7: Connected to other fake accounts
Some fake accounts are part of a fake-account network. These accounts Like each other?s posts and pictures, and may even make short comments or post emojis to further the illusion. I?ve found a large network of ?young female Trump supporters? that was at least 20-people large at the point I stopped working on tracking it.
One of the more interesting networked fake accounts I?ve seen was a brother-sister pair where the brother had posted a picture of ?himself? and his ?sister? at a baseball game, tagged his sister in the post, and she had commented on it. I predict we?ll only see these more complex, world-building strategies more and more as time goes on.
When trying to find networks of fake accounts, it?s important to examine the very first publicly visible posts made by the account. For example: you scroll down to the very first public post, made only a few months ago, and it?s a profile pic upload. (You could also use the Photos tab as a shortcut.) You look at the Likes on that photo and take note of the names. Then you look at those accounts and go back to some of their initial posts and look at who Liked those; you may start to see some overlap of names. When combined with several of the other fake-account clues for even a single account, this can be a sure sign that the entire network is fake.
The dates that initial uploads happened can be a clue, too. For example: you see that a bunch of accounts that have all Liked each other photos also had their first visible content posted right around the same date, maybe even on the same day.
This is one fake account from a pretty large network of fake accounts. This is her first publicly visible post, made in July 2017. Several of the accounts who liked this first post were also fake and also uploaded their first publicly-visible posts around the same time.
Next steps
What should you do if you think you?ve spotted a fake account? First thing to do is report the account to Facebook, which you can do by selecting Report from any account?s main page. There is currently an option for ?This account is a fake account.?
This may not be enough, though; I?ve reported a lot of fake accounts to Facebook and every single time Facebook responded with a generic message that the account was not violating terms and services.
If Facebook doesn?t do anything, email the account URL and what makes you suspicious to me using my Contact form at www.readingpokertells.com/contact. I?ll put it in my spreadsheet and maybe make it public at some point. The goal is to show Facebook how big a problem this is.
An additional thing you can do, if you want to do more work on your own, is to Friend the account. I?ve been accepted as a Friend of many fake accounts and this allows you to see more of their profile and account, which can make it easier to determine if the account is fake. Sometimes they will even chat with you if you ask them questions; I?ve interacted with several accounts run by Macedonians.
More info
Some more resources:
- My piece showing some specific examples of fake Facebook accounts.
- My piece about the fake/spam websites themselves.
For more information, search online for ?Macedonian fake news? and ?Russian Facebook accounts? and you?ll find a lot more information. Some more articles and resources are mentioned in the articles linked above.
Another thing to think about: as we all become more savvy about fake social media accounts, the fake account creators will become more savvy. Many of these fake accounts are only distinguishable as fake accounts because the creators were very sloppy and didn?t really care to hide their tracks; they were going for quantity over quality. I?ve spent a good amount of time outing dozens of fake accounts in Facebook groups, and over the last few months I?ve already seen an improvement in fake account strategy/appearance. There are several accounts I suspect are fake but I cannot prove it based on the usual methods.
