How to Catch a Catfish: 6 Signs and How to Verify Someone Online

What catfishing actually is

Catfishing is when someone builds a fake online persona — usually with stolen photos and invented details — to start a relationship under false pretences. The motives split in two. Some catfish are individuals acting out of loneliness or a desire to be someone else; the deception is real but there's no financial endgame. The rest are commercial fraud, often run by organised teams working from scripts, where the relationship is the delivery mechanism for a payment.

The scale of the second category is not small. Romance scams reported to the US Federal Trade Commission accounted for roughly $1.14 billion in losses in 2023, with a median individual loss around $2,000 — higher than almost any other fraud category the FTC tracks, because these run for months before the ask.

Either way the fix is the same and it comes before the emotion, not after: confirm the person exists as described. Almost every serious bad outcome here depends on the other side controlling an identity you can't check.

Six red flags to watch for

No single sign is proof, but they stack. If several are true at once, treat the account as unverified until you've actually checked something.

• •They won't do a live video call. The camera is broken, the signal is bad, the screen is cracked. The excuse changes; the outcome doesn't.
• •The story escalates far faster than the contact justifies — intense affection within days, talk of a shared future before you've been in the same room. Emotional pace is what stops you checking.
• •The photo set is too clean: uniform lighting, always flattering, no clutter, no other people. And the profile is thin — recently created, few followers, no tagged photos, no comments from people who clearly know them offline.
• •Details drift between conversations — job, city, age, the name of a sibling — because scripted personas are run across many targets at once. And money enters the picture in some form: a medical emergency, a customs fee, a flight home, a 'guaranteed' crypto opportunity.

Check the photos first — it's the fastest answer

Photo verification takes about three minutes and ends a large share of cases outright. Save two or three images and reverse image search each separately, because scammers routinely mix a stolen set with a generated image and only one will hit.

Use all three engines, because they fail differently. Google Lens is best for general web matches; Yandex is markedly stronger on faces and often finds the real owner when Google returns nothing; TinEye sorted oldest-first finds the earliest indexed appearance. A photo that first surfaced on a stock library or a stranger's 2015 blog is stolen. Nothing at all is normal for a private person; the same face under a different name is not. Generated images still fail on details: mangled hands and teeth, mismatched earrings, jewellery that changes between shots, nonsensical background text.

Verify with a username search

Fake identities are thin because depth takes years to build. Real people leave a long, boring tail — an old gamertag, a Letterboxd, a Strava, a Steam profile, a forum login from 2016. That tail is very hard to manufacture, and it's the thing to look for.

If your match has given you any handle — a Snapchat, a Telegram, an Instagram, a gamertag, or just the part of their email before the @ — check where else that exact string is registered. A genuine identity typically lights up across several unrelated platforms with consistent photos and a history stretching back years. A fabricated one is either a dead end or leads to accounts whose content contradicts the story you've been told. AliaScan checks a handle against 400+ platforms in seconds and links each public profile. It reads public pages only — it confirms an identity has a footprint, it can't confirm a legal name, and it can't see inside private accounts or dating apps.

The live video test

This is the check fake identities cannot pass, and the one people skip because asking feels rude. Frame it as ordinary safety practice and offer to do the same yourself.

Keep it short and unscheduled — a call arranged for 8pm tomorrow gives a scammer a day to prepare. Ask for something that can't be pre-recorded: a specific word you pick in that moment, or a full head turn side-on. A profile turn defeats most real-time face-swap filters, as does passing a hand slowly across the face.

If the camera is broken every time, or an emergency appears the moment you ask, that is a finding rather than an obstacle.

The money script, and how it starts

Financial catfishing follows a recognisable arc. Weeks of attentive contact build the relationship first — the invested time is what makes the later request work. Then a plausible obstacle to meeting, then a first ask that is small and framed as temporary.

The payment method is the tell. Every route they'll suggest is irreversible: gift card codes read out over a message, a wire, a crypto transfer, or Zelle, Cash App or Venmo sent as a personal payment. Investment variants — pig butchering — send you to a convincing trading site where your balance appears to grow, small withdrawals are honoured to build trust, and the account locks when you try to take out anything substantial. A related pattern skips money: intimate images are solicited and then used for extortion, where paying reliably produces further demands.

What to do if you confirm a catfish

Being targeted is not a failure of judgement — these are professionally run scripts. Stop sending money immediately, and don't send anything compromising. If you've already paid, contact your bank the same day — the US Fair Credit Billing Act allows a card dispute within 60 days of the statement, and network chargebacks typically run to around 120 days. Wires can occasionally be recalled within hours; crypto cannot be reversed at all.

Then preserve and report. Screenshot the profile, messages, payment details and URLs before you block anything, because accounts disappear the moment they're reported. File with the platform, and in the US with reportfraud.ftc.gov and ic3.gov; in the UK, Action Fraud. If intimate images are involved, StopNCII.org generates hashes to block their spread without you uploading the images.