Profile Cloning & Impersonation Scams

Profile cloning impersonation scams involve a scammer creating a near-identical copy of your social media profile using your publicly available name, photo, and biographical information. The cloned account is then used to contact people who know you — friends, family, professional contacts, or followers — and solicit money, personal information, or engagement with malicious links, all while impersonating you.

Unlike account takeover, which requires the actual compromise of your account, profile cloning requires nothing beyond access to the public-facing parts of your profile. Any photo you post publicly, your displayed name, your location, and your listed interests can be copied in minutes and assembled into a convincing duplicate.

The cloned account may be used to run romance or emergency scams against your existing contacts, to spread misinformation attributed to you, to solicit fraudulent brand deals using your follower count as a selling point, or to operate a fake business page associated with your real identity and professional reputation.

This scam is particularly disorienting for the genuine account holder, who often only discovers the clone when contacted by friends who received suspicious messages, meaning significant harm can be done before any remediation is possible.

The scammer downloads profile photos, copies display names, and replicates biographical details from the target's public account. They create a new account with the same or near-identical name and upload the stolen materials. Where usernames are available, they choose one as close to the original as the platform allows.

The clone is then used to send friend or follow requests to the target's existing connections, often targeting people who may not notice the subtle username difference or who will simply accept a request from a face they recognise. Once a connection is established, the scammer uses the trust built by the real person's existing relationship to make requests.

Common requests include emergency cash transfers, voting for a fabricated competition, clicking a link to view a video or news story, or providing contact details. In professional cloning, the scammer approaches the target's professional network offering to sell services or request business information.

The target's real account remains unaffected throughout, making discovery slower and complicating the victim's ability to warn contacts efficiently.

Humans recognise faces before examining other details. When a connection request arrives showing a familiar face and name, the instinctive response is recognition rather than scrutiny. The extra cognitive step of checking whether you are already connected — which would reveal the duplicate — requires deliberate effort that most people do not apply automatically.

For professional networks, a cloned profile can exploit years of reputation-building. Colleagues and clients who receive messages from what appears to be a known professional contact lower their guard in ways they would not for an unknown party.

Hi, this is my new profile — my old one got hacked. Can you add me again? It's [name].

Hey, I'm in trouble — I lost my wallet while travelling. Can you send [amount]? I'll pay back as soon as I'm home.

I set up a new business page. Can you give it a like and share? Here's the link: [link]

I created a new account after some issues with the old one. Please ignore any messages from the old profile.

Did you see this video? Someone said it was you — watch it here: [malicious link]

When you receive a friend or connection request from someone you believe you are already connected with, check your existing connections list first. If you are already connected, the new request is a clone.

Search for the person's name directly on the platform and compare the number of accounts that appear, the account creation date, and the follower or friend counts. A recently created account with few connections is likely a clone even if the photos and name are familiar.

Contact the real person through a separate channel — a phone call, a different messaging app, or their verified email — to confirm whether they sent a new request.