This story has been updated. It was originally published on March 19, 2020.
I’ve been impersonated online four times (that I know of). Three times, someone took my self-portraits and used them to catfish people on Tinder. The other time, someone created an email address and pretended to be me researching an article on Instagram accounts for a site I used to write for. They reached out to big accounts and attempted to get them to hand over their login credentials. In all four cases, I had no idea it was going on until someone who was directly affected contacted me to ask if they were being scammed. I have no idea how many other people were taken in.
Of course, it’s not uncommon for public figures caught up in the news cycle or some kind of controversy to be impersonated by trolls. For example, Katie Bouman, a scientist involved in taking the first ever photo of a black hole, was quickly impersonated online. Sexist trolls did what sexist trolls do and tried to manufacture outrage and controversy where there was none.
But if you’re not a public figure, online impersonation can be a bit more personal. If someone is posting your private information or reaching out to your friends, it’s likely someone you know—or are at least acquainted with. This is probably the hardest situation to deal with.
Having my identity stolen left me feeling pretty weird. Someone was out there, lying to people and using my face or professional reputation to do it. If you’re in the same situation, I’m sorry—it sucks. But there are a few things you can do.
Consider why it’s happening
What the person impersonating you is trying to achieve will determine what you can do about it.
With the three catfish attempts, the scammer just used my photos. They were in a different country, using a completely fictional profile. It was me but it wasn’t me. In those cases, I found out when one of their victims reached out to me and asked if they were being catfished. They’d suspected something was up and reverse image-searched the pics. While I don’t know exactly why my photos were used, I can only assume it’s because, a) I’m gorgeous, and b) there are plenty of photos of me available online that someone could use to build a realistic profile.
In the fourth instance, the scammer was trying to leverage my identity as a writer to steal the login details to some big Instagram accounts. I’d written an article about top Instagram accounts a few months before and they were using it as part of their amateurish (and ultimately unsuccessful) con. This one struck a little closer to home since they were actually pretending to be me.
[Related: Simple advice to protect all your online accounts]
Also, before launching yourself to wild conclusions, think about whether it could be a case of mistaken identity. Unless you have a super-rare name, there is almost certainly someone out there who shares yours. There are even two Harry Guinness-es (Harry Guinnessi? Harrys Guinness?). Just because someone has a Twitter or Instagram account with the same name as you doesn’t mean they’re impersonating you—unless, of course, they’re stealing and sharing your photos. Your name might be Will Smith, but you’re not entitled to the Twitter handle @willsmith.
Report the profile
If someone is truly impersonating you on a social media platform, online dating app, or elsewhere, your first step is simple: report the hell out of them. Impersonating someone is against pretty much every site’s terms of service—Facebook, Twitter, Reddit, and Instagram all ban it. If you can show that someone has set up a fake profile as you, report, report, report.
Unfortunately, as with all things internet, this doesn’t always work. Twitter, in particular, seems to be willfully obstinate when it comes to shutting down impersonation accounts. There are plenty of examples of Twitter refusing to take action, even when present with evidence that people’s accounts have been directly copied. Tinder, at least, was quite responsive—the three profiles impersonating me were quickly shut down once the victims reported them for catfishing.
But if someone is impersonating you with an email address, website, WhatsApp account, or some other non-identity linked platform, there’s not a lot you can do. For example, Gmail’s terms explicitly state that they are “unable to participate in mediations involving third parties regarding impersonation.” If someone is impersonating you by email, Google won’t do a thing.
Minimize the damage
Impersonation can do a lot more harm when other people don’t know it’s going on. If someone is pretending to be you, don’t stay quiet: announce it on your Facebook profile, pin it to the top of your Twitter timeline, and rant about it on any soapbox you have. It could scare them into stopping.
And even if it doesn’t stop them, at least their attempts at deception have been made public. Someone who searches for you online will be able to see which are your official profiles—and which aren’t.
One idea that gets thrown around a lot is verification, but it’s not really a solution for most people. Twitter’s verification program is currently undergoing review (though I was able to get verified after the Instagram impersonation incident) and was pretty capricious to begin with. Instagram still has a verification option, but it’s aimed at “public figures, celebrities and brands.” You can apply for verification by going to Settings > Account > Request Verification and uploading a photo of your ID, but you’re unlikely to be successful unless you’re a genuine public figure—there’s no way to plead your case or explain why you need to be verified. My verification request was rejected. Facebook’s process is a little better, but it’s still just for public figures and celebrities. You can apply by filling out this contact form, and there is a place where you can explain why your account should be verified. Still, you’re unlikely to be successful unless you really are a public figure.
The legal route isn’t easy
If nothing’s working, it might seem logical to go to the police, but the legal situation is actually pretty complicated.
The laws to stop someone from impersonating you online depend on where the impersonator lives and where the company hosting the posts is based, explains David Reischer, attorney and CEO of LegalAdvice.com.
“The criminal online impersonation laws vary from state to state, as does the threshold for triggering the law,” he says. “There are, at present, no federal internet impersonation laws, and only nine states have laws that make it illegal to impersonate another person on the internet.”
Your attorney would need to file a court-approved subpoena forcing the website to stop the impersonator from making new posts, remove any old posts, reveal their identity (if it’s known), and disclose their IP address.
[Related: This free tool can reveal who is behind any internet domain]
Things are a little easier if you know who is impersonating you (or get the website to reveal who they are). You could consider a civil lawsuit, but your ability to prove your case against the impersonator will depend on the applicable state laws for claims of defamation, harassment, professional impersonation, or false light, Reischer says.
In other words, there’s not a lot you can do if you don’t know who’s impersonating you. And if you do, you’re most likely going to need to pursue a lengthy civil action, unless you live in one of the few states where impersonating someone online is a crime and you can get the police interested in pursuing it.
Let it blow over
Unless someone is taking things to the point that getting lawyers involved makes sense, there’s not a lot you can do but wait it out.
As far as I know, no one is impersonating me online at the moment. The three catfishes seemingly stopped when Tinder quickly shut down their profiles, and the Instagram impersonator didn’t get anywhere with their scam, so they wound it up after a few weeks. If you’ve found an imposter, report them; shout about it from the rooftops; but, once you’ve done that, ignore them. If you can, move on. That’s what I had to do.