Impersonation and fake-profile evidence

Why impersonation evidence decays fastest

Impersonation accounts are built to be disposable. They rename themselves when reported, migrate followers to successor accounts, delete and repost to reset visibility, and frequently exist on several platforms at once with slight variations. Of all online-harm categories, this one punishes slow capture the hardest: the profile you describe in a report may not exist by the time anyone reviews it. Capture the state, not just the existence.

Capture the profile as a living object

Preserve the visible profile state and the surrounding context that connects it to the protected person or brand. Treat every element of the profile as evidence: the handle, the display name, the bio, the avatar, the link-in-bio target, the join date if visible, and the content pattern.

• Handle, display name, profile URL, captured together, since they diverge over time
• Profile image and banner, saved as files where possible (often copied from the real person)
• Bio text and any links, including where the links resolve
• Follower/following counts and visible audience signals at capture time
• Posts, replies, and direct references to the impersonated person
• Prior names where the platform exposes rename history

Document the contact, not just the profile

Impersonation harms through contact: messages sent to the victim's colleagues, family, clients, or followers in the victim's name. Where recipients can share what they received, capture it with the recipient's context, who received it, when, on which platform, and what it asked for. Solicitation patterns (payment requests, link-clicks, "new account" stories) are often the clearest evidence of intent.

Map related accounts and references

A single fake profile is often part of a wider pattern. Keep related profiles, copied bios, reused media, and cross-platform references connected without overstating attribution, shared imagery and synchronized activity are observations; common authorship is an inference and must be labeled as one.

• Accounts reusing the same avatar, bio fragments, or naming pattern
• Cross-platform variants of the same impersonation
• Successor accounts that appear after reports or suspensions
• Timing patterns worth noting: creation dates, synchronized posting windows

Preserve the report history

Platform reports and their outcomes are part of the evidence. They establish notice, document the platform's response or silence, and matter for any later escalation. Record every report filed, by whom, when, through which channel, and what came back.

• Report date, platform, reporting channel, and reference number where given
• The platform's response, including no-response, with dates
• Account state changes that followed (rename, deletion, suspension, no change)

Record uncertainty explicitly

Good evidence files state what is visible, what is inferred, and what remains unknown. "Same avatar as account A (observed)" and "likely operated by the same actor (inferred from timing and reuse)" are different classes of statement. That distinction helps reviewers move faster without relying on unsupported claims, and protects the file's credibility when one inference turns out wrong.

From profiles to pattern

The end state is not a folder of profile screenshots; it is a chronology in which accounts appear, act, get reported, mutate, and reappear, with every step sourced to a capture. That pattern view is what lets counsel assess the matter as a campaign rather than as isolated annoyances, and it is the part no screenshot folder produces by itself.