A catfishing investigation is designed to test whether the person behind an online profile is genuinely who they claim to be. Verification is not about hacking an account or secretly accessing private messages. It is about comparing identity details, photographs, usernames, employment claims, locations, public records, online history and other lawful information until the story either becomes consistent or clear contradictions appear.
At Trojan Investigations, we approach suspected catfishing as an identity-verification problem. We start with what the client already knows, separate facts from assumptions, preserve relevant evidence and use proportionate enquiries to establish whether the online identity can be independently corroborated.
Published: 28th September 2026
How Can You Verify Whether an Online Person Is Real?
The strongest verification does not depend on one clue. It combines several independent checks:
- whether photographs appear elsewhere under another name;
- whether the claimed name, age, location and work history are internally consistent;
- whether usernames connect to older, credible accounts;
- whether professional or business claims can be corroborated;
- whether the person's timeline changes when compared with public information;
- whether contact repeatedly avoids ordinary verification such as a live video call or an in-person meeting;
- whether money, cryptocurrency, gift cards, investments or financial favours enter the relationship; and
- whether the profile appears newly created, copied or disconnected from a believable real-world history.
No single test proves identity. The aim is corroboration: several reliable facts pointing to the same real person.
Catfishing and Romance Fraud Are Not the Same Thing
Catfishing broadly describes presenting a false or materially misleading identity online. The motive may be attention, emotional manipulation, harassment, concealment, sexual exploitation, fraud or another purpose. Romance fraud is narrower: the false relationship is used to manipulate a victim into sending money or value.
That distinction matters because a person can be lying about identity without yet asking for money, while an apparently genuine profile can still become part of a fraud. The investigation therefore needs to answer two separate questions: who is this person? and what are they trying to achieve?
Start by Preserving What You Already Have
If an online identity later disappears, changes username or deletes a profile, basic evidence can be lost quickly. Before confronting the person, preserve the information already visible to you: profile URLs, usernames, photographs, dates, payment requests, phone numbers, email addresses and the parts of the conversation you are lawfully entitled to retain.
Do not edit screenshots in a way that removes context. Record the date and platform, and where possible preserve the original message or file as well as a screenshot. If money has been requested, keep bank details, cryptocurrency wallet addresses, invoices or payment instructions without sending further funds.
Photographs Are Useful, but They Are Only One Layer
Reverse-image searching can reveal that a profile photo belongs to another person, appears on unrelated accounts or has circulated for years. The UK government's Stop! Think Fraud campaign specifically recommends researching profile photographs when romance fraud is suspected.
But a clean reverse-image search does not prove authenticity. Images can be newly stolen, cropped, mirrored, AI-generated or taken from private accounts that search engines have never indexed. A photograph should therefore be treated as one identifier among many rather than a pass-or-fail identity test.
| Clue | What it may indicate | What it does not prove |
|---|---|---|
| Photo appears under another name | The image may have been copied or the account may use an alias | Who actually controls the profile |
| No old social history | The identity may be new, curated or deliberately compartmentalised | That the person is automatically fraudulent |
| Avoids video calls | Identity verification is being resisted | The exact reason for avoiding the call |
| Employment cannot be corroborated | A major biographical claim may be false or exaggerated | That every other part of the identity is false |
| Requests money or investment | The risk moves from identity deception toward financial fraud | That recovery will be possible after payment |
| Different names or ages appear | There may be aliases, copied identities or deliberate deception | Which version is genuine without further evidence |
Usernames Often Connect More Than a Display Name
People frequently change display names while reusing distinctive usernames, profile handles, email prefixes or business names. Lawful open-source research can compare those identifiers across publicly accessible services and older webpages.
The investigator should not assume that two matching usernames belong to the same person. Common handles can be duplicated, accounts can be impersonated and scraped profile pages can be out of date. A useful match is one that also aligns with photographs, locations, dates, interests, contact details or other identifiers.
Employment and Professional Claims Can Be Tested
Catfish profiles often use authority to build trust: military service, medicine, engineering, finance, offshore work, entrepreneurship or an overseas posting. Some claims can be checked through genuine public professional, corporate or business information, while others cannot.
Our personal investigation work focuses on whether the claimed identity leaves a credible real-world footprint. We do not invent pretexts to obtain protected employment records or private personnel information.
Addresses and Locations Need Corroboration
A claimed city is easy to copy into a profile. A stronger location picture comes from consistent public information over time: business links, older posts, event photographs, local references and other evidence that makes sense together.
Investigators should distinguish between a residential address, a company service address, a workplace, a hotel, a temporary location and a location merely mentioned online. Treating any one of those as a person's home can create serious error and privacy risks.
Live Verification Can Be Helpful, but Deepfakes Change the Standard
A spontaneous video call remains a practical identity check, particularly where the person has repeatedly relied on static photographs. However, synthetic media means a video image should not be treated as absolute proof by itself. The context still matters: does the person respond naturally, can they discuss information consistently, and does the interaction align with the wider identity evidence?
The National Crime Agency's July 2026 romance-fraud campaign highlighted reluctance to use video calls or meet in person as a warning sign, alongside unrealistic profile images, pressure to move conversations to encrypted platforms and requests for money or investments.
Avoid “verification” methods that create a new offence or privacy breach
Do not try to guess passwords, take over an account, send malware, install spyware, secretly access someone else's cloud backup, obtain bank records through deception or impersonate police or government officials. An investigation should reduce uncertainty, not create legal exposure for the client.
What About Phone Numbers and Email Addresses?
A phone number or email address can be a useful identifier, but possession does not prove the claimed identity. Numbers can be virtual, recycled or registered in another person's name. Email addresses can be newly created or deliberately anonymous.
Useful analysis looks at consistency: when the identifier first appears, whether it is connected to public business activity, whether the same contact detail appears under conflicting names and whether the timing fits the relationship history. Investigators should not promise private telecom subscriber records that they have no lawful right to obtain.
Money Requests Change the Risk Assessment
Where the person asks for money, gift cards, cryptocurrency, an “investment”, customs fees, medical expenses, flights, visa costs or a transfer through your account, the matter should be treated as a potential fraud risk rather than only a relationship question.
The National Crime Agency and Stop! Think Fraud both warn that romance fraud is built through trust before a financial request appears. If money has already been sent, preserve payment details and contact the relevant bank or payment provider promptly. A private investigation can support evidence gathering, but it does not replace reporting a suspected crime.
Good verification produces a confidence assessment, not a dramatic reveal
A professional conclusion may be “the claimed identity is strongly corroborated”, “material elements cannot be verified”, or “the evidence indicates the profile is using another person's identity”. That is more useful than forcing every case into a simple real/fake label when the evidence is incomplete.
How We Structure a Catfishing Investigation
1. Record the claimed identity
We separate stated facts — name, age, occupation, location, family circumstances and history — from assumptions the client has made during the relationship.
2. Preserve identifiers
We organise usernames, photographs, phone numbers, email addresses, profile links, payment details and dates into a clear working chronology.
3. Test independent sources
Lawful public and open-source information is checked for corroboration, conflicts and evidence that the images or biography belong to somebody else.
4. Resolve the highest-risk contradictions
If the employment, location or identity story conflicts, the investigation concentrates on the contradiction that is most important to the client's decision instead of collecting unlimited personal information.
5. Report fact, inference and uncertainty separately
Our report records what was found, what it supports and what could not be confirmed. Where the concern extends into fraud or litigation, our legal and litigation support can be scoped around the evidence actually required.
Can Surveillance Help Verify an Online Identity?
Sometimes, but only where it is necessary and proportionate to a defined question. For example, a client may need to know whether the individual they have been communicating with is the person attending an agreed public meeting or whether a claimed routine is materially false.
Our surveillance services are not a substitute for digital identity work and should not be used merely to satisfy curiosity. The investigation should have a legitimate purpose, a clear scope and a stopping point.
What If the Catfish Is Targeting a Business?
False identities also appear in invoice fraud, supplier impersonation, recruitment fraud, executive impersonation and social-engineering attacks. In those cases, the verification process may include corporate records, domain history, payment instructions, publicly stated roles and communication chronology.
Our business investigations can examine the wider fraud indicators while preserving the original communications and avoiding unauthorised access to accounts or systems.
Information to provide for a catfishing investigation
- the exact name and spelling the person uses;
- all known usernames and profile URLs;
- photographs in their original form where possible;
- phone numbers and email addresses;
- claimed occupation, employer and location;
- the date contact began and major changes in the story;
- details of proposed meetings or repeated cancellations;
- money or investment requests, including payment instructions;
- copies of messages you are lawfully entitled to provide; and
- the specific decision you need the investigation to help you make.
Verification Should Protect the Client as Well as Identify the Subject
Catfishing cases can involve embarrassment, emotional dependency, financial loss or fear that intimate material will be exposed. A good investigation therefore includes practical risk control: stop further payments where appropriate, preserve evidence, avoid retaliatory contact and do not reveal more personal information to the unknown person while verification is underway.
If you need a discreet assessment of an online identity, you can book a confidential consultation with Trojan Investigations. We can define the identity questions first and explain which lawful checks are proportionate to the circumstances.
Why Identity Verification Needs a Timeline
Catfishing stories often fail not because one detail is obviously impossible, but because the details do not remain stable over time. A person may say they moved to a new city, changed jobs, travelled overseas or lost access to an account. Each explanation can sound plausible in isolation. When the dates are mapped together, contradictions may become much clearer.
We therefore separate the relationship into dated events: first contact, changes of phone number, new photographs, cancelled meetings, claimed travel, financial requests and changes in employment or family circumstances. A timeline also helps prevent memory from becoming evidence. The client may remember that something happened “around Christmas”, while the message history shows it occurred weeks earlier. Precision matters.
How to Assess an Online Profile Without Overreacting to Normal Privacy
Not everybody has a large public footprint. Some genuine people use little social media, keep their accounts private, avoid LinkedIn or do not want to share an employer with a new online contact. Those choices are not proof of deception.
The more meaningful question is whether the identity can be corroborated at a level consistent with the relationship. A person who says they are a company director may reasonably leave a different public footprint from someone who works in a private role. A person who has spoken daily for six months but refuses every live verification step presents a different risk from someone who simply does not publish personal information publicly.
What Happens When the Profile Uses a Real Person's Identity?
Some catfish profiles copy the name and images of a real person while the account is controlled by somebody else. In that situation, the genuine person may also be a victim. Contacting them recklessly can cause distress or alert the person operating the false account.
A professional report should therefore distinguish between the identity being represented and the person controlling the account. Proving that photographs belong to a real doctor, soldier, executive or influencer does not prove that the client has been speaking to that individual.
International Catfishing Claims Need Extra Caution
Overseas employment, military deployment, oil-rig work, shipping, remote engineering projects and international business travel are common narratives in romance fraud because they help explain why an in-person meeting is difficult. They can also be completely genuine occupations.
International verification should therefore focus on objective claims that can be tested lawfully: whether the employer exists, whether the job description is plausible, whether the person's public history aligns with the claimed country and whether the same images or biography appear elsewhere. A private investigator should not promise access to immigration, airline, military or government databases simply because the story involves another country.
Sources and References
- UK Finance — Fraud Report 2026, including 2025 APP fraud and romance-fraud figures.
- National Crime Agency — Fraud Explained: Romance Fraud.
- National Crime Agency — Romance-fraud public awareness campaign, 29 July 2026.
- Stop! Think Fraud — Protect yourself from romance fraud.
- Information Commissioner's Office — UK GDPR lawful basis and legitimate interests guidance, updated March 2026.
- Information Commissioner's Office — Association of British Investigators UK GDPR Code of Conduct for Investigative & Litigation Support Services.
- Computer Misuse Act 1990.
- Data Protection Act 2018 and UK GDPR.