A fake profile does not need to force anything. It asks to come in, with a smiling photo and a few mutual friends, and waits for someone to open the door.
Fake profile attacks are exactly that: attempts at fraud, data gathering or manipulation that start from an account built to look like a real person. A fake profile is an account showing an identity that has been invented or borrowed from someone else. Creating one takes no technical skill, which is why it is one of the most widespread tools on social networks.
This post explains how the most common attacks work when they come in through a contact accepted too lightly: from the clone of a friend’s profile to networks of automated accounts. It is the threat-side companion to the recommendation on connecting only with people you know.
One useful clarification: this post describes how these attacks work from the point of view of the person on the receiving end, so that you can recognise them and defend against them. It contains no operational instructions.
The starting point
One evening you receive a friend request from someone you met on a course, years ago. The photo is the one you remember, and there are about ten mutual friends. You accept without thinking: after all, you know them.
Two days later a private message arrives. A friendly tone, a few vague memories, then a request: a small loan for something unexpected, or a link to vote in a competition, or an opportunity that “changed the life” of one of their relatives.
Only later do you find out that the real person still has their own profile, active and untouched, and has never written to you. What you accepted was a copy.
Why accepting strangers increases the risk
All the attacks that follow share one thing: they do not need to get past any technical defence, they only need to be accepted.
Once inside your circle, a fake profile gains three things:
- Visibility. A lot of information is visible only to friends or followers: family photos, places you go, important dates, the names of your children or colleagues.
- Credibility with others. Every accepted contact becomes a “mutual friend” who reassures the next person. Someone who already has you among their contacts looks more trustworthy in your friends’ eyes.
- A direct channel. Private messages between contacts get past many filters and arrive with a sense of familiarity that an email from a stranger does not have.
To understand what is really exposed, the post on the risks of accepting strangers online describes the effects on privacy and reputation.
1. Cloning a friend’s profile
In plain terms. Someone copies the name, photos and public details of a person you know, and sends you a friend request from a new, identical account.
How it works. There is no need to get into the original account: the information visible to everyone is enough. The cloned profile contacts the copied person’s friends, counting on the fact that many of them will not remember whether they were already connected. After a few days the requests arrive: money, codes, links.
Why an unverified contact makes it more likely. A clone only works if someone accepts it without checking. The resemblance to a real person does the rest.
Possible impact. Requests for money that seem to come from a friend, links spread towards scam pages, information gathered about you and your network.
What should make you suspicious. A request from someone you thought was already among your contacts, a profile with little recent content, a tone that does not match the person’s usual one. The post on the signs of a fake profile brings together the indicators to look out for.
How to protect yourself. Before accepting, check whether that person is already among your contacts. If in doubt, ask them to confirm through a different channel: a phone call, or a message to the number you know. A clone is not the same as a hacked account: if the real account has been taken over, the problem also affects the services connected to it, as the post on the consequences of a hacked social account explains.
2. Profiles built up over time to earn trust
In plain terms. An account is created with an invented identity and “grown” for weeks or months before it asks for anything.
How it works. It posts ordinary content, likes things, comments politely, joins interest groups. It becomes known as a kind and steady presence. Only once trust is established does the request arrive, and by then it seems natural.
Why an unverified contact makes it more likely. Patience is its strength: no single message looks suspicious. The acquaintance is purely digital, and nobody has ever checked it away from the screen.
Possible impact. Handing over personal or work information, being drawn into financial scams, your trust being used to approach other people.
What should make you suspicious. Someone you have never met who quickly becomes very present, who avoids video calls or meetings, who has a rich personal story that is hard to verify.
How to protect yourself. Tell the difference between knowing someone in real life and digital familiarity. Someone you have never met, or at least spoken to on a video call, remains a stranger even after many friendly messages.
3. Romance scams
In plain terms. A fake profile builds an emotional relationship with a person, and then asks for money or favours.
How it works. The contact often starts on a social network or a dating service. Frequent conversations, attention and shared plans follow. Then an obstacle appears — a journey, a health problem, a blocked bank account — that only financial help can solve. The requests tend to be repeated.
Why an unverified contact makes it more likely. These scams rest on the genuine feelings of the people they target. There is nothing naive about trusting someone who has given you time and attention: that is precisely what the mechanism is built on.
Possible impact. Financial losses, sometimes significant ones, but above all personal pain that deserves respect and a listening ear, not judgement.
What should make you suspicious. A relationship that moves very fast, a constant inability to meet, a request to move the conversation to a private messaging app, the first request for money, however small.
How to protect yourself. Talk to someone you trust before sending money. A sincere relationship has no need to ask for money from someone the other person has never met face to face. The resource on fake dating apps looks more closely at the services built specifically for these purposes.
4. Investment scams
In plain terms. A profile, often projecting an image of financial success, offers easy returns through a “private” investment.
How it works. The contact arrives as friendly advice, sometimes from the cloned profile of an acquaintance. It shows results, screenshots of earnings, testimonials. The first investment seems to pay off, and that persuades people to put in more. When they try to withdraw the money, unexpected fees or blocks appear.
Why an unverified contact makes it more likely. Advice that comes from a “friend” carries more weight than an advert. And a network of accepted contacts makes it possible to reach many people with the same offer.
Possible impact. Financial losses, sometimes repeated, and the risk of being contacted again by people who promise to “recover” the money lost.
What should make you suspicious. Guaranteed returns, urgency (“limited places”), unknown platforms, pressure not to talk about it with anyone.
How to protect yourself. No serious investment starts with a private message. Always check, away from the social network, who is making the offer and through which authorised firm.
5. Gathering information for targeted phishing
In plain terms. A fake profile watches what you share in order to build tailor-made messages, far more believable than a generic scam.
How it works. Targeted phishing is a deceptive message written for one specific person, with real details that make it convincing. Colleagues’ names, places, trips, birthdays: everything visible to contacts becomes material. The message can arrive by email, text message or chat, and seems to come from someone you really know.
Why an unverified contact makes it more likely. Many details stay hidden from the public but are visible to friends. Accepting a fake profile means opening up exactly that part.
Possible impact. Theft of credentials (the username and password you sign in with), fraud against you or your family, access to work accounts.
What should make you suspicious. Messages that mention personal details in a slightly forced way, urgent requests that seem to come from people close to you. The post on how to recognise phishing explains the most common signs.
How to protect yourself. Share less with people you do not know, and remember that photos and their hidden data say a lot too: the location saved in images (turning off photo geotagging) or a QR code visible in a photo are extra information for anyone watching.
6. Networks of automated accounts
In plain terms. Groups of profiles run by software, known as bots, that follow one another and act together to look like real people.
How it works. These accounts add contacts in bulk, amplify posts, spread links or opinions, and inflate follower counts. On their own they seem of little importance; together they create the impression that something is popular, reliable or widely shared.
Why an unverified contact makes it more likely. Every accepted request makes the network more credible and lets it reach your contacts. The algorithms that suggest new connections also tend to propose profiles linked to the ones you already have: the post on how friend suggestions work explains this mechanism.
Possible impact. Exposure to scams and disinformation, unintentionally spreading misleading content, data gathered on a large scale.
What should make you suspicious. Recently created profiles with many contacts, generic names, repetitive activity at all hours, identical comments on different posts.
How to protect yourself. Do not accept requests just because you have mutual friends, and report suspicious profiles to the platform.
Summary table
| Attack | Main risk | What should make you suspicious | Effective defences |
|---|---|---|---|
| Profile cloning | Requests made in a friend’s name | A request from someone already among your contacts | Checking your contacts, verifying through another channel |
| Profiles built up over time | Trust used to ask for something | A constant presence, no real-life meeting | Telling real acquaintance from digital familiarity |
| Romance scams | Financial losses and personal pain | A fast-moving relationship, requests for money | Talking to someone you trust |
| Investment scams | Money paid into fake platforms | Guaranteed returns, urgency, secrecy | Checking the authorised firm away from the social network |
| Targeted phishing | Believable messages built on your data | Personal details mentioned, urgent requests | Sharing less, verifying the sender |
| Networks of automated accounts | Artificial credibility, disinformation | Recent profiles, repetitive activity | Not accepting because of “mutual friends”, reporting |
What they have in common
Six different attacks, three defences that cut across almost all of them:
- Accepting only people you really know — it takes away the attacker’s easiest way in.
- Verifying through a different channel — it takes apart clones, scams and phishing, which all rely on trust and haste.
- Controlling who sees what — it limits the material available to anyone watching; the post on how to clean up your social connections explains how to review your circle.
These are not complicated measures. Future Security Measures on social media privacy will go deeper into the settings; in the meantime, the resource on security and privacy settings is a good place to start.
Protection checklist
- ☐ I accept requests only from people I really know
- ☐ Before accepting, I check whether that person is already among my contacts
- ☐ I verify every request for money or codes through another channel
- ☐ I do not treat “mutual friends” as proof of trustworthiness
- ☐ I review my list of contacts and followers periodically
- ☐ I limit personal information and family photos to friends only
- ☐ I never invest in offers received in private messages
- ☐ I report fake or cloned profiles to the platform
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Awareness | Understanding that a fake profile exploits trust, not a technical weakness |
| Skills | Recognising the mechanism of each attack from its signals |
| Secure Behaviour | Checking before accepting, and before answering an unusual request |
Reference level: FL3 — Autonomous, with elements of FL2 — Beginner in the part on basic checks.
Conclusion
Fake profile attacks do not only catch people who are distracted or inexperienced: they can catch anyone, because they use the most human thing there is, trust in someone who seems familiar. Anyone caught up in one has nothing to be ashamed of.
That is why the most effective defence is not to be suspicious of everyone, but to choose with care: a circle made of real people, and a check through another channel when something does not add up.
If you want to see how solid your digital habits are, the digital resilience self-assessment helps you take stock.
Something to think about. Among your contacts on social media, how many would you recognise if you passed them in the street?
Related resources
Short pieces from the Resources section, for anyone who wants to focus on a single aspect:
- Fake Dating Apps: Recognising the Ones Built to Extract — the services built for romance scams
- How to Recognise Phishing When It Is Built to Be Convincing — the signs of tailor-made messages
- Security and Privacy Settings: The Half Hour Worth Spending — controlling who sees what
Related content
- Connecting only with people you know — the recommendation this belongs to
- Signs of a fake profile — the indicators these attacks leave behind
- How to clean up your social connections — the steps to put things right and prevent them
- How friend suggestions work — the technology that can make them easier
- Consequences of a fake profile among your contacts — what they lead to when they succeed
- Risks of accepting strangers online — what is exposed: data, reputation, relationships
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
