Every viral thread has them in the replies: accounts that aren't what they pretend to be. Some are automated, some are humans running scripts, some are impersonators wearing a famous name, and some are ordinary trolls with a stock photo. Learning to read the signals takes about ten minutes, and it permanently changes how you evaluate what you see. Here's the working checklist — along with honest notes about which classic signals no longer work.
Start with the profile's skeleton
- Join date vs. behavior. An account created last month that posts three hundred times a day about one divisive topic is telling you what it is. Check the join date on every account that provokes a strong reaction in you — it's on the profile, and it's the hardest signal to fake.
- The follower ratio. Following 4,900 accounts with 12 followers suggests follow-back farming. Thousands of followers on an account that has never posted anything interesting suggests purchased followers. Neither is proof; both are flags.
- The handle itself. Impersonators rely on typography: a capital I for a lowercase l, doubled letters, an underscore or extra digit appended to a famous handle. When a "celebrity" or "official" account says something explosive, read the handle character by character before reacting.
- Profile photo provenance. Stock photos and stolen photos are the classic tells, checkable by reverse image search. The newer wrinkle is AI-generated faces, which reverse search won't find anywhere — uniqueness is no longer proof of authenticity. Look instead at whether the account has photographic history: real people accumulate varied, imperfect, contextual images over years; fake personas have one perfect headshot and nothing else.
Then read the behavior
Automation and coordination leave rhythm signatures. Scroll the account's timeline (a viewer tool works fine for this if you're not logged in) and ask: Does it post around the clock with no sleep gap? Does it reply within seconds to hundreds of unrelated threads? Is the timeline pure reposts with no original text, or the same phrasing recycled across dozens of replies? Humans are bursty and inconsistent; scripts are metronomes.
Coordinated networks — dozens of accounts pushing one narrative — are harder to spot from a single profile, but they betray themselves in the aggregate: identical talking points with slight word swaps, clusters of accounts created in the same week, and reply sections where "independent" voices all arrived within a minute of the post. Trend manipulation works exactly this way, as we describe in our piece on trending topics.
Signals that no longer mean what people think
- The blue checkmark. Since 2023 it primarily indicates a paid subscription, not verified identity — the full story is in our verification explainer. A blue check on an account claiming to be a company or official should increase your suspicion that impersonation is being purchased, not decrease it. Look for gold (organization) or gray (government) badges instead, which retain vetting.
- Fluent, personalized text. The old advice — bots write clumsily — died with large language models. Automated accounts now write idiomatic, context-aware replies. Text quality has simply stopped being a signal in either direction.
- Bot-detector websites. Third-party "bot probability" scores were always rough heuristics, and the API changes that killed most research access (see the login wall story) made them blinder. Treat any percentage score as decoration.
The impersonation special case
For accounts claiming to be someone specific, verification is straightforward: find the person's known account or website through a search engine — not through the platform — and see whether it links to or matches the account in question. Real organizations link their social accounts from their own domains. An account announcing a company's "new policy," a celebrity's "statement," or a token giveaway, without any trace on the entity's own channels, is fake until proven otherwise. This thirty-second check would prevent most impersonation scams from ever landing.
When you're confident: report, block, move on
If an account clears the bar from suspicious to clearly fraudulent — impersonating a real person, running a giveaway scam, spamming identical replies — use the report flow (the menu on any post or profile) and pick the specific category; impersonation reports in particular carry weight because platforms face legal pressure on them. Then block and leave. Don't reply, don't quote-post the exposé: engagement-ranked systems read your dunk as interest and show the scam to more people, and scam operations routinely farm outrage replies for reach. The most damaging thing you can do to a fake account is deprive it of the interaction it exists to harvest — and the report button does the rest quietly.
Calibration, not paranoia
Two closing cautions. First, don't flip from gullibility to reflexive "bot!" accusations — real people with unpopular opinions, new accounts, and non-native phrasing get wrongly dismissed constantly, and the accusation has become a lazy way to avoid engaging with arguments. The signals above are cumulative evidence, not a one-strike test. Second, remember that the goal isn't identifying every fake — it's making sure the accounts that inform your view of the world are real. For the loudest claims in your feed, spend the thirty seconds. For everything else, a healthy default skepticism — the same one we recommend in our viral post verification toolkit — does the job.