How scammers use fake profiles and social media to trick you

Quick answer

Social media is now the most expensive way for a scammer to reach you. According to FTC data published in April 2026, nearly 30% of people who reported losing money to a scam in 2025 said it started on social media, with $2.1 billion in reported losses — eight times the 2020 figure, and more than any other contact method.

The fake profile is the shared foundation under almost all of it. Three checks expose most of them:

1. History — when was the account created, and does its activity look lived-in?
2. Images — do the photos appear elsewhere under other names?
3. Behaviour — does it push toward private messaging, then toward money?

The third is the only one that is decisive, which is why patience beats inspection.

Why social media, and why now

The FTC's data is worth reading closely, because it contradicts some assumptions:

• Facebook accounted for the largest reported losses, with WhatsApp and Instagram next.
• More money was lost to scams starting on Facebook alone than to text and email scams.
• Investment scams dominate — $1.1 billion, more than half the social media total.
• Every age group except the over-80s lost more to social media than to any other contact method. For the over-80s, phone calls still led.

The structural reasons are simple. Accounts are free and instant. Adverts can be targeted by age, interest and location. A direct message arrives with none of the filtering an email faces. And the platform itself supplies the social proof — mutual friends, follower counts, a profile that looks like a person.

Meta removes fake accounts at enormous scale, hundreds of millions per quarter, which tells you both that enforcement is real and that supply is effectively unlimited.

How a fake profile is built

Understanding the construction is what makes them visible.

The photos come from somewhere. Stolen from a real person's public account, taken from stock libraries, or generated. Generated faces have become good, so "does this look like a real person" is no longer a useful question.

The history is thin, and this is the harder thing to fake. A real account accumulates years of ordinary noise: tagged photos by other people, comments from the same handful of friends, posts about nothing. A fake account has posts without conversation.

The friends are often bought or reciprocal — large follower counts with almost no engagement.

The name is designed to survive a glance. For impersonations, a copy of the real name with an added underscore, a full stop, or a swapped character.

The bio is aspirational and vague: a job title, a city, a flag, a quote. Enough to feel like a person, not enough to check.

The main scams that run on them

Investment and crypto

The largest category by money lost. It rarely starts as an investment pitch. It starts as a conversation — a friendly message, a shared interest, weeks of ordinary chat — and the investment appears later as something the person happens to do well from. You are shown a platform with a working dashboard and rising numbers. Small withdrawals succeed. Larger ones require a fee, then a tax, then nothing.

Investment scams covers the mechanics in full.

Romance

The same patience, with a different destination. Weeks or months of genuine relationship-building before money is mentioned, which is why the people affected are not naive — they are invested. Romance scams covers the timeline and the signals.

Impersonating someone you know

A cloned profile copies a friend's name and photos, then messages their contacts. The request is usually small and plausible: a favour, an emergency, a link, a competition they are trying to win.

Impersonating a brand or a celebrity

Fake support accounts that reply to complaints about a company, fake giveaway accounts, fake investment tips attributed to well-known people. Meta reported removing millions of profiles impersonating public figures in a single half-year.

Marketplace and shopping

Listings that vanish after payment, sellers who insist on a payment method with no protection, buyers who "overpay" and ask for the difference back. Shopping scams covers the payment side.

Job offers

Recruitment messages for roles that do not exist, ending in an advance fee, an equipment payment, or a money-mule arrangement. Job scams has the detail.

Warning signs on the profile

• Created recently, or with a long gap where nothing happened
• Photos with no history — no tags from other people, no one else in them, no ordinary background
• Followers who never interact
• A name with an odd character — an underscore, a full stop, a doubled letter
• A bio that could belong to anyone
• Photos that appear elsewhere. Reverse image search the profile picture; a stolen photo often surfaces under a different name

Warning signs in the behaviour

These matter more, because a well-made profile passes the checks above.

• An unprompted friendly message from someone you do not know
• A very fast move to WhatsApp, Telegram or Signal — off the platform, away from its reporting tools
• Refusal to do a spontaneous video call, or one that is brief and glitchy
• Their story never quite lets you check anything — an oil rig, a deployment, a contract abroad
• Flattery and intensity out of proportion to the time elapsed
• A profitable opportunity mentioned casually
• Any request for money, a gift card, cryptocurrency, or a verification code
• Pressure and deadlines once money is in view

A two-minute check

1. When was the account created? Most platforms show a join date or "new to Facebook" style marker.
2. Reverse image search the profile photo. Right-click and search by image, or use a reverse image search site.
3. Look for other people in the photos, and for comments from the same friends over years.
4. Check for a duplicate. If they claim to be someone you know, search the name — a second account with the same photos is a clone.
5. Suggest a spontaneous video call. Not scheduled. Refusal, or an excuse about the camera, tells you a great deal.
6. Ask something specific and checkable — the name of a place, a mutual contact, a detail from a shared past.

What to do if you have been talking to one

• Stop replying. You do not owe an explanation.
• Do not confront them. It teaches them what failed, and can lead to threats or blackmail attempts.
• Screenshot the profile and the conversation before anything disappears.
• Report the account inside the platform, using the impersonation or scam category rather than generic spam.
• Block, then check whether they have contacted your friends.
• If you sent money, contact your payment provider immediately, then report at ReportFraud.ftc.gov and IC3.gov. How to report an online scam covers the order.
• If you shared personal details, change passwords on anything those details could help reset, especially email.
• If intimate images are involved, do not pay. Reporting routes exist and paying does not end it — report to the platform and to law enforcement.

Reducing how often it happens

• Make friend and follower lists private. They are a target list for clone attacks.
• Restrict old posts in bulk — most platforms have a single setting for this.
• Strip the profile fields a stranger can use — date of birth, contact number, where you grew up, where you work. They double as security question answers.
• Turn off message requests from strangers, or route them to a folder you check deliberately.
• Do not accept requests from people you have not met, including ones with mutual friends — mutual friends are exactly what a clone attack produces.
• Set up an alert for your own name, so you find impersonations of you early.

How to protect your personal information online covers the wider cleanup.

Key takeaways

• Social media was the costliest fraud contact method in 2025, with $2.1 billion reported lost.
• Investment scams starting on social media accounted for $1.1 billion of that.
• Profile appearance is easy to fake; history and behaviour are much harder.
• A friend requesting you from a new account is the classic clone attack.
• The decisive test is the eventual request, not the quality of the profile.
• Locking down friend lists and old posts removes most of the raw material.