How to Verify Someone's Identity Before You Trust Them Online (2026)

Run the photo through FaceSift

Upload their profile photo to FaceSift to find where that face appears across the public web. A genuine person's face will typically appear on their own social media, their employer's website, or news coverage — all under the same name. A stolen photo will surface on profiles belonging to someone with a completely different name, often in a different country. This is the fastest single check available.

Run the same photo through Google Images

Google's reverse image search finds exact file copies and visually similar images. Drag the photo to images.google.com or right-click → 'Search image'. If the same photo appears on multiple profiles under different names, or on a stock photo site, the image is stolen. Google catches different cases than face search — use both.

Check for signs the photo itself is AI-generated

If reverse search finds nothing, the photo may be AI-generated rather than stolen — a face that does not exist on any other platform. Look for the visual tells: blurred or asymmetrical ears, garbled background text, teeth that blur together, unnaturally smooth skin at full zoom. Upload to Hive Moderation (hivemoderation.com) for an automated probability score. See our full guide on deepfake detection for a complete checklist.

Check multiple photos, not just one

If they have provided several photos, run each one. A scammer may use one real stolen photo for the main profile image and AI-generated images for the rest — or vice versa. Inconsistency between photos is itself a red flag: different lighting styles, image quality, or backgrounds that never feature the same environment suggest multiple unrelated source images.

Search their name across multiple platforms

Search their full name on LinkedIn, Instagram, Facebook, Twitter/X, and Google. A real person in their claimed profession will typically have a LinkedIn profile consistent with their stated career history, a social media presence that predates your contact with them, and some footprint — even if small — beyond the platform where you met them. Absence across all platforms is suspicious; presence only on the platform where you met is more suspicious.

Check account creation date and history

LinkedIn shows the month and year a profile was created. Twitter/X shows join date. Instagram does not show creation date directly, but the date of the earliest post is visible by scrolling down. A profile created in the months before you met them — with no history of earlier activity — is a significant red flag regardless of how polished it looks.

Look for a genuine social graph

Real people appear in other people's photos, are tagged by friends, have followers who interact in ways that suggest actual relationships, and follow accounts that reflect real interests. A profile with 400 followers but no tagged photos, no comments from people who appear to know them personally, and a following list of celebrities and brands has no genuine social graph — it was built for appearance.

Check whether their LinkedIn matches their claimed backstory

If they claim to be a doctor, engineer, or executive, their LinkedIn should reflect that career in detail — with employment dates, job titles, and connections from colleagues. Vague job descriptions, no listed employer, employment gaps that coincide with their claimed adventure stories, or an employer that does not appear to exist are all worth investigating.

Search their username across platforms

Use a tool like Sherlock or simply search their username in quotes on Google. If the same username appears across gaming forums, old Reddit accounts, or community sites in ways inconsistent with their claimed identity — or if the username appears nowhere else despite them claiming to be active online — both are informative. Scammers frequently reuse usernames across targets or use freshly created handles with no history.

Request a video call early — before emotional investment grows

The longer you wait to request a video call, the more emotional investment has accumulated on both sides, and the harder it becomes to make the request feel natural. Ask within the first week of contact, before the relationship has a dynamic that makes the request seem like an accusation. Frame it positively: 'I'd love to actually see you — are you free for a quick call this week?'

Notice the excuses, not just the outcome

A legitimate person who is genuinely busy, camera-shy, or in a different time zone will usually agree to a video call within a reasonable timeframe while explaining the delay. A scammer will produce an escalating series of reasons — broken camera, poor internet, work restrictions, military deployment rules, or a platform that 'does not support video' — that never resolve. The pattern of avoidance is more telling than any single excuse.

During the call: ask them to do something spontaneous

Pre-recorded video can be played on a second device to fake a live call. During the video call, ask them to do something unscripted and immediate — wave with a specific hand, hold up a particular number of fingers, turn to show their left side, or write your name on a piece of paper and hold it up. A live person can do this instantly. A pre-recorded video or a poorly executed deepfake cannot.

Watch for signs of a deepfake video call

AI-powered real-time face swap is possible and increasingly accessible. Signs: face boundary flicker at the hairline or ears during movement; lighting on the face that does not respond naturally to head rotation; blinking that is too infrequent or incomplete; lip sync that degrades during fast speech. If anything looks subtly wrong, ask them to move further from the camera — deepfakes degrade at distance — and watch what happens.

Confirm details during the call that match their profile

A genuine person's environment during a video call will be consistent with their claimed life — a home or office that matches their described situation, background sounds appropriate to their claimed location, and physical appearance consistent with their photos. Major inconsistencies — wrong apparent nationality, accent inconsistent with claimed background, environment completely mismatched to their story — are worth noting and questioning directly.

Verify their employer independently

Do not use contact information they provide. Search for the employer independently — find the company's official website, phone number, or LinkedIn page through your own search — and confirm whether the person they claim to be is listed. For large organisations, HR departments will confirm whether someone is employed there without disclosing private details. For smaller companies, a direct call often suffices.

Check military claims against public records

Military romance scams are so prevalent that the US Army Criminal Investigation Division has a dedicated page for them. Key facts: US military personnel serving abroad are not allowed to ask civilians to send money, gift cards, or wire transfers for any reason. They have access to free communication and do not need you to pay for a phone or internet service. The Defense Manpower Data Center (dmdc.osd.mil) offers a service member verification tool.

Look up their claimed professional credentials

Doctors are licensed and their licences are publicly searchable through state medical boards (US) or equivalent bodies in other countries. Lawyers are registered with their state bar. Engineers in many jurisdictions have professional registration numbers. A claimed credential in a licensed profession can be verified in minutes through the relevant regulatory body's public search tool.

Ask specific, verifiable questions about their claimed work

Someone who genuinely works in a specific field will answer detailed questions about it without hesitation — procedures, jargon, daily realities, institutional names, colleagues. Someone working from a script will give vague answers, redirect, or provide details that do not match how that profession actually works. Ask the kind of questions that only someone with real experience could answer correctly.

They forget details you have already told them

A person genuinely invested in building a relationship remembers what you have shared. A scammer managing dozens of simultaneous conversations from a script periodically asks questions you have already answered — sometimes within the same conversation. This is not forgetfulness; it is the signature of someone who does not have a dedicated record of your specific exchanges.

Their messages arrive at unusual times for their claimed location

If someone claims to be in London but sends 'good morning' messages at 3am London time, or claims to be in Los Angeles but goes offline during LA daytime, their actual location is not where they say it is. Message timestamps are a simple but often overlooked check. Most messaging apps show the time messages were sent in your local timezone — convert it.

The relationship accelerates faster than normal

Declarations of love within days, talk of a future together within weeks, and intense emotional intimacy before you have met in person are all markers of manufactured urgency. Genuine relationships develop at a pace that reflects real-world social norms. Artificial acceleration is a technique to build emotional commitment before the target has time to think critically.

They push for secrecy with your friends and family

Encouraging you to keep the relationship private, framing concern from friends and family as jealousy or misunderstanding, and creating a sense that 'only you understand me' are all isolation tactics. They serve to remove the social checks that most people rely on to catch problems in relationships — the friend who says something feels off, the family member who asks uncomfortable questions.

Any request for money or financial information

This is the definitive line. A genuine person you have met online and not yet met in person has no legitimate reason to ask for money, gift cards, cryptocurrency, bank details, or any financial assistance. The request may be framed as a temporary emergency, a medical crisis, a stuck shipment, or a business opportunity — the specific framing is irrelevant. The request itself is the answer to every verification question.