S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T24.22
CATEGORY Internet Scams
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Social Media Clone Accounts

Impersonation Fraud · Copied-Profile Con · High
Red Flag
How It WorksSEC 01

A clone account is impersonation aimed not at the person copied but at the people who trust them. The offender copies a target’s public profile — display name, profile and cover photos, bio, sometimes scraped posts — to produce a convincing look-alike, then sends friend or follow requests and direct messages to the target’s real contacts. Because the message appears to come from someone the recipient knows, ordinary skepticism drops: a request that would be dismissed from a stranger is entertained from “a friend.”

The offender then runs a small con through the borrowed identity — a claimed emergency needing quick money, a “you should apply for this government grant, here’s the agent” referral, a crypto or giveaway “tip,” a request to receive a verification code (to hijack the recipient’s own account), or a link to a phishing page. Cloning is cheap and fast because it needs only public information; no account is actually hacked. It differs from account takeover (where the real account is compromised and messaged directly) and from catfishing (a wholly fabricated persona rather than a copy of a real one).

The trust being spent is the copied person’s reputation. Clones are often short-lived and thrown away once reported, and offenders run many in parallel; a common secondary harm is that the impersonated person must warn their network and clean up, while defrauded contacts may blame them.

Warning SignsSEC 02
  • A request from someone you already follow. A friend or follow request from a contact you are already connected to — the classic duplicate-profile tell.
  • Out-of-character messaging. A note from a “known” contact that is oddly formal or riddled with slightly-off phrasing.
  • A thin, new profile. Few friends or posts, a recent creation date, and photos copied from the real person.
  • A fast pivot to money or access. A quick steer toward cash, gift cards, crypto, a “grant,” a link, or a request to receive a verification code.
  • Urgency that discourages checking. Pressure not to confirm the story another way.
  • A recent “I've been cloned” notice. The real person having just warned contacts not to accept new requests from them.
Frequently Paired WithSEC 03
  • Impersonation Scams · T24.19
    Sibling impersonation fraud
  • Identity Impersonation · T12.12
    The impersonation home entry
  • Catfishing / False Identity · T10.3
    Fabricated vs. copied persona
  • Phishing · T14.2
    Delivers links or intercepts codes
How the Scam UnfoldsSEC 04
  • Stage 01 · Copy
    The offender scrapes a public profile — name, photos, bio — to build a look-alike; nothing is hacked, only copied.
  • Stage 02 · Connect
    Friend/follow requests and DMs go to the real person's contacts, borrowing recognition to lower the skepticism a stranger would trigger.
  • Stage 03 · Con
    A small con runs through the borrowed identity — emergency money, a “grant” referral, a crypto tip, a verification code, or a phishing link.
Counter-ProtocolSEC 05
Defense: Verify through a different, known channel before acting. If a “friend” messages needing money, a code, or steering you to an opportunity, call or text them on their real number, or message the account you already follow, to confirm it is really them.
  • Check for a duplicate. If you are already connected, a new request from the same person is almost certainly a clone.
  • Never act on a DM alone. Don't send money, gift cards, or crypto, share a verification code, or click a link based only on a social-media message from a “known” contact — no real friend needs your verification code.
  • If you're cloned, warn your network fast. Post from your real account, report the fake to the platform for impersonation, and ask contacts to report it too.
  • Tighten privacy. Limit who can see your friend list and photos to make future cloning harder.
  • Help defrauded contacts report to reportfraud.ftc.gov, ic3.gov, and the platform, and reverse any payment through their bank, card, or crypto exchange quickly.