A friend request takes one tap to accept. Most of the time there is a real person behind it. Sometimes, though, there is a profile built specifically to look familiar.
This post brings together the signs of a fake profile: the clues you can notice by looking at a profile or chatting with whoever runs it, which suggest that the person is not who they claim to be. For each sign you will find what it means, where you can see it and what to do when you come across it. In technical circles these are called indicators of compromise, or IOCs (Indicators of Compromise): here we apply them to the people who join your circle of contacts.
It is the diagnostic deep dive on the recommendation about connecting only with people you know.
What the indicators of a fake profile are
An indicator is an observable trace suggesting that something does not add up.
When it comes to social media contacts, there are three terms worth knowing:
- fake profile: an account created with an invented or borrowed identity, in order to gain trust, information or money;
- cloned profile: a copy of a real person’s profile, with the same name and the same photos, used to contact their friends;
- social engineering: the set of techniques someone uses to persuade a person to do something — reply, click, pay — by playing on trust rather than exploiting a technical flaw.
A sign is not proof. It is an invitation to check: a new profile may belong to someone who has only just joined, and a very polished photo may simply be a good photo. The value of these indicators lies in when you notice them: before you accept a request, or early on, while the conversation is still just beginning.
Why they matter more when you accept requests from strangers
If your circle only includes people you know, a suspicious profile stands out straight away: it does not match anyone you have actually met.
When you accept requests out of politeness, out of curiosity or because “we have friends in common”, your circle expands to people nobody can vouch for. From that point on, every new contact sees what you share with your friends — photos, trips, the names of family members, where you work — and can message you with the credibility of someone who is “already one of your friends”.
There is a knock-on effect too: a fake profile you accept becomes, for your own contacts, a mutual friend. The risks are covered in detail in the post on the risks of accepting strangers online.
Signs on the profile
These are the ones you can see by opening the profile, before you exchange a single message.
| Indicator | What it means | Why it matters | Where you see it | What to do |
|---|---|---|---|---|
| Recently created profile | The account has existed for a few weeks or months, yet presents itself as an adult with a well-established life | Fake profiles are often created in batches and abandoned once they are reported | Joining date, earliest posts, “About” section | Do not accept straight away; check through a channel you already know |
| Few, very polished photos | Three or four perfect images, often from a photo shoot, and no everyday pictures | The photos may have been taken from other profiles or from stock image sites | Albums and profile photos | Look the image up with a search engine’s image search: if it appears under another name, the profile is very likely not genuine |
| Mutual friends who do not know the person | The profile shares contacts with you, but none of them can say who it is | Whoever creates fake profiles first adds people who are willing to accept, so as to look part of the group | List of mutual friends | Ask one of those friends, in a separate message, whether they really know the person |
| Duplicate of a friend’s profile | You receive a request from someone who is already one of your contacts, with the same name and the same photo | This is the typical sign of a cloned profile | Incoming requests; searching for the name among your contacts | Do not accept; let your friend know through a different channel and report the profile |
| Vague or inconsistent information | A vague job (“entrepreneur”, “doctor working abroad”), a city that keeps changing, an age that does not match the photos | An invented identity rarely holds up under detail | “About” section, posts, comments | Treat it as one clue to add to the others |
| Unbalanced ratio of contacts to activity | Lots of friends or followers, very few posts and hardly any interaction | It suggests a profile built to collect contacts rather than to share anything | Number of contacts, post history | If it is the only sign, keep an eye on it; if it adds to others, do not accept |
| Odd username | Extra letters or numbers, or a name slightly different from the one displayed | It may mean the name was already taken by another account — in other words, a possible clone | Profile address, username below the display name | Compare it with the person’s original profile, if you know them |
Signs in the conversation
These do not require you to examine the profile: they emerge as you chat with the person, often after just a few messages.
| Signal | What it means | Why it matters | How you notice | What to do |
|---|---|---|---|---|
| Asking to move to a private chat | The person insists on switching to another messaging app, away from the social network | Outside the social network there are fewer filters, fewer ways to report and no public history | “Message me here, I hardly ever use this one” | Stay where you are; if they keep insisting, that is one more reason to stop |
| Asking for codes | They ask you to forward a code you received by text message or email | That code is almost always used to get into your account or to register a service in your name | “A code was sent to you by mistake, could you send it over?” | Never send it, to anyone: a verification code is as personal as a key |
| Asking for money | A loan, a phone top-up, an urgent payment for something unexpected | It is the end goal of many fake profiles | Sudden emergencies, medical bills, luggage held at customs, “safe” investments | Do not pay; if they say they are a friend, call them on the number you already have |
| Very fast romantic interest | Constant compliments, declarations of love within days, plans to meet that keep getting postponed | This is the basis of romance scams: trust first, then the request | Intense conversations with someone you have never seen | Talk it over with someone you trust; a genuine connection can stand up to a check |
| Refusing video calls or meetings | There is always an excuse: a broken camera, work abroad, a weak connection | Someone using another person’s photos cannot show their face | Suggestions to meet that go nowhere | Treat it as a strong sign, especially alongside others |
| Unusual personal questions | Your first pet’s name, the school you went to, your children’s dates of birth | These are often the answers to your accounts’ security questions | Questions that seem harmless but come early on | Answer vaguely, or do not answer at all |
| Links to open or files to download | “Look at this photo”, “is this you in this video?” | It may be a page that imitates the social network’s sign-in screen to steal your password | Links sent in chat with no context | Do not open them; if the message comes from a friend, check with them first |
| Urgency and secrecy | “Don’t tell anyone”, “you have to decide now” | Urgency is there to stop you from pausing to think | Growing pressure in the conversation | Stop: a legitimate request can easily wait an hour |
A concrete example
Sarah receives a friend request from Luke, an old classmate from university. Right name, right photo, twelve mutual friends. She accepts without a second thought.
The next day Luke messages her: he has changed phones and, by mistake, gave Sarah’s number to receive a code — could she forward it to him? Sarah hesitates. Then she notices a detail: Luke has been one of her contacts for years.
She calls him on his old number. Luke knows nothing about the request: someone copied the name and photos from his profile and messaged many of his friends. Three of them had already accepted, and that had made the clone more convincing for everyone else.
The decisive sign was the first one: a second request from someone who was already among her contacts. On its own it looked like a glitch; read as an indicator, it was enough not to accept.
What to check right away
Before accepting a request
- do you know this person outside the social network?
- are they already one of your contacts, under another profile?
- how long has the profile existed, and how many photos does it contain?
- do your mutual friends really know them?
Among the contacts you have already accepted
- people you would not recognise in the street;
- profiles with no activity, or with photos that have not changed in years;
- contacts who have only ever messaged you to ask for something.
On your own profile
- who can see your photos, your friends and your personal information;
- whether your public details have grown too numerous over time.
How to go through the list calmly, without having to do it all at once, is explained in the post on how to clean up your social connections.
If you find a suspicious sign
- Do not respond to requests for codes, money or personal details, however friendly the tone.
- Check through a different channel. If the profile claims to be a friend, call them or message them on the contact details you already have.
- Remove or block the contact. You owe no explanation to a profile you do not recognise.
- Report the profile to the social network, stating whether it is a fake identity or a copy of another person.
- Warn anyone who may be involved: the friend who was cloned and, if needed, your mutual contacts.
- If you have already sent a code or a password, change the password on the account concerned right away and turn on a second factor to protect your account, meaning an extra check on top of the password.
If messages you did not write have already been sent from your account, that is a different issue, covered in the recommendation on messages sent in your name. What can happen when a fake profile stays in your circle for a long time is described in the post on the consequences of a fake profile among your contacts.
What is not an indicator
Telling the difference helps you avoid two opposite mistakes: being suspicious of everyone, and getting used to ignoring the real signs.
| Situation | Why it is usually not a signal |
|---|---|
| A new profile belonging to someone you know | Plenty of people join late, or set up a new profile after losing access to the old one: a direct confirmation is enough |
| Few photos on an active profile | People who value their privacy post little — and they are right to |
| A request from a colleague in another department | Contacts from work or from clubs and associations are normal, as long as the person exists and you can check |
| A friend suggestion made by the social network | It is generated by an algorithm based on contacts and interests, not by the person being suggested |
| A friend messaging you from another app | If they use a number you know and do not ask for codes or money, it is an ordinary conversation |
The rule of thumb: one isolated sign deserves a check; two signs together are reason enough not to accept, or to remove the contact.
How suggestions work, and why they show you people you do not know, is explained in the post on how friend suggestions work.
How often to check
There is no need to keep watch over your contacts: a light habit is enough.
| Frequency | What to check |
|---|---|
| With every friend request | The four questions from “What to check right away”: they take a few seconds |
| When a contact asks for codes, money or to switch apps | Check through another channel before replying at all |
| Every 3–4 months | A review of your contacts: people you do not recognise, people you have not heard from in years, people who only ever asked for things |
| Every 6 months | Who can see the photos, friends list and personal information on your profile |
| When a friend reports a cloned profile | Whether you received, or accepted, the same request |
A regular reminder works better than good intentions.
Two important warnings
An indicator is not proof. A recent profile, a polished photo or a mutual friend who does not remember the person may all have perfectly ordinary explanations. Checking does not mean accusing: it means asking for confirmation from someone who can give it.
No indicators is not a guarantee. Some fake profiles are built with care, with years of posts and believable photos. That is why protection does not rest on spotting every deception, but on the starting rule: accept and follow only people you really know. The signs help you catch the exceptions; they do not replace the rule.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read a profile — creation date, photos, mutual friends — and recognise the requests typical of fake profiles |
| Awareness | Understanding that every contact you accept sees what you share and becomes a “mutual friend” for others |
| Secure Behaviour | Checking through a different channel before accepting or replying, and reviewing your contacts regularly |
Reference level: FL2 — Beginner. This is the level at which you learn to recognise the most common signs and apply a simple check before trusting someone.
Conclusion
The signs of a fake profile are not meant to make you suspicious of everyone who messages you. They are meant for the opposite: knowing what to pause on for a few seconds, so that you can welcome the real people with confidence.
What to do right now. Open your list of pending friend requests and go through them with the four questions in this post. Then scroll through your contacts and look for anyone you would not recognise: removing them takes a moment. To see where you stand on the other aspects of your digital security, you can take the digital resilience self-assessment.
Other related topics have their own space: using your social profile to sign in to other services is covered in the recommendation on limiting social login; what the photos you post can give away is covered in the recommendations on posting photos with QR codes and turning off photo geotagging. Social media privacy settings will have dedicated Security Measures of their own.
Related resources
Short deep dives from the Resources section, for anyone who wants to focus on a single aspect:
- Fake Dating Apps: Recognising the Ones Built to Extract
- How to Recognise Phishing When It Is Built to Be Convincing
- Security and Privacy Settings: The Half Hour Worth Spending
Related content
- Connecting only with people you know — the recommendation this belongs to
- Fake profile attacks — the techniques that generate these signs
- How to clean up your social connections — what to do, calmly and in the right order
- Consequences of a fake profile among your contacts — what happens when a sign is confirmed
- Risks of accepting strangers online — what every accepted contact is exposed to
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
