How to Find Out Who Is Behind a Fake Account

Decide what outcome you're actually after

People asking how to unmask a fake account usually want one of three things: the account gone, the behaviour stopped, or a name. Those need very different work, and they are not equally achievable. Removal is the fastest and most reliable — platforms act on impersonation and harassment reports without you identifying anyone. Stopping the behaviour often follows removal, or comes from a documented pattern handed to police or a lawyer. A confirmed real-world name is the hardest, frequently impossible from public data alone, and the one where a mistake does the most damage.

Work all three in parallel, but front-load the reporting. Evidence also disappears when accounts get deleted, so capture everything before you file anything.

• •Screenshot every post, message and the profile itself, with the full URL and a visible timestamp in frame.
• •Save the account's numeric ID or profile URL, not just the display name — handles change, IDs don't.
• •Keep a dated log of incidents. A pattern is what platforms and police act on; a single post rarely is.

Harvest every identifier the account gives you

A fake account is still an account, and accounts leak. Before you search anything, inventory what the profile is already telling you. The handle itself is the highest-value item: people making burner accounts routinely reuse a string they already own somewhere, because a name you can remember is easier than a name you can't.

• •The exact @handle, plus the display name and any previous handles visible in old posts or mentions.
• •The profile and banner images — reverse image search them, since stolen photos usually trace back to an unrelated real person.
• •Any link in the bio: a Linktree, a shop, a Discord invite, a second social account.
• •The account creation date, and the posting-time histogram — a consistent daily window is a strong timezone hint.
• •Writing tells: recurring misspellings, punctuation habits, emoji choices, regional slang.
• •The follower and following list, especially overlap with the real person's circle — fakes almost always follow people they know.
• •The masked email or phone hint some platforms show on a password reset screen, which can confirm or exclude an address you already suspect. Read it, don't attempt the reset.

Run the handle and the variations

Once you have the handle, check where else that exact string is registered. This is the step that most often produces a break, because the burner name was rarely invented from scratch — it is a gamertag from a decade ago, an old forum login, or the front half of an email address. Where the same handle appears on a platform the person uses as themselves, you have a candidate.

Test variations too. People iterate rather than invent: appended numbers, a dot swapped for an underscore, a prefix like 'the' or 'its', a suffix like 'real', 'official' or their initials. AliaScan runs one handle against 400+ platforms in parallel and links each public profile it finds, which turns a long afternoon of manual URL checks into a short list to review. It reads only public pages — it cannot see who registered an account or what is behind a login.

Corroborate before you conclude — misattribution is the real risk

The failure mode here is not finding nobody; it is confidently finding the wrong person. Stolen profile photos belong to a real human who has nothing to do with this, and pointing a crowd at them causes serious harm. Common handles collide. A shared IP or a mutual follower is not identification. And the person you already suspect is exactly the person your reasoning will bend toward, which is precisely why you need external checks.

• •Require at least two independent signals that are not the handle: image, writing style, timing, link fingerprint, network overlap.
• •Actively look for evidence against your hypothesis. If you can't articulate what would disprove it, you aren't investigating.
• •Grade your conclusions honestly — possible, probable, confirmed — and never publish anything below confirmed.
• •Never name a suspect publicly. Even when you're right, it invites defamation exposure and hands the other side a story.

The routes that actually produce a name

IP addresses and account registration details sit with the platform, and platforms release them to law enforcement or under a court order — not to users, and not to any service selling you a lookup. That means the realistic paths to a legally usable identity are a police report, or a civil action where your lawyer can subpoena the platform. Both need the documentation you gathered in step one, which is why it comes first.

In the meantime, use the reporting channels built for this. Instagram, X, Facebook, TikTok and LinkedIn all have dedicated impersonation forms, and reports filed by the person being impersonated are prioritised. In the US, report harassment and online crime to IC3 at ic3.gov and to local police. If the account involves a minor, report to the NCMEC CyberTipline. Getting the account down and the pattern documented is usually the outcome that ends the problem — the name is often not required.