Someone is pretending to be you online. Capture the profile before you report it

Why reporting first is a mistake

You find an account using your name and your photographs. The natural response is to report it and get it taken down as fast as possible. That instinct is right about the goal and wrong about the order.

When a platform accepts an impersonation report, the account disappears. So do the posts, the messages sent from it, the follower list, and the profile itself. Platforms do not hand you a copy of what they removed, and support requests months later rarely produce one. If anyone later asks you to prove what that account claimed or who it contacted, you have nothing but your own account of it.

A successful report destroys the evidence. That is fine — as long as you made a record first.

Work out the scope before you act

Impersonation and identity theft are different problems with different responses, and the same incident can be both. Before doing anything, establish which one you are dealing with.

• A fake profile using your name and photos, posting or messaging as you — impersonation. The platform is your main route.
• Your photos on a profile under a different name, typically used to defraud a third party — impersonation of a sort, but you are the tool rather than the target.
• Accounts, loans or contracts opened in your name — identity theft. The platform is now secondary; banks, credit registers and the police matter more.
• Messages or payment requests sent to your contacts in your name — impersonation with a fraud element, which raises the urgency considerably.

The distinction matters because the second and third cases involve other victims and other institutions, and those follow their own timelines. Sorting this out first prevents you from spending a week on a takedown while a loan is being drawn in your name.

What to capture, before you report anything

Ten minutes here decides what you can prove for the next two years. Capture everything, including what you have not read yet — you cannot go back and add it later.

• The profile page in full: display name, handle or profile URL, biography, profile and cover photos, join date if shown
• The numeric or permanent profile identifier where the platform exposes it, because handles can be changed and reused
• Every post, story or comment made from the account, particularly any that damage your reputation or solicit money
• Your own photographs as used on the account, so you can later demonstrate they are yours
• Messages sent from the account — yours, and screenshots from contacts who received them
• The follower and following lists, or at least their counts, which indicate the reach of the deception
• Anything showing intent to defraud: payment requests, links, invented affiliations with your employer

A plain screenshot serves for a platform report. It is considerably weaker if the matter reaches the police or a court, because an image carries no verifiable link to a time, an address or an unaltered source. A forensic capture records the page together with its URL, timestamp and network response, sealed cryptographically, so any later change is detectable and the record can be checked by anyone.

Capture first, report second. In that order the platform removes the account and you still hold the proof.

How to report an imposter account, platform by platform

Every major platform prohibits impersonation and every one has a dedicated route for it, separate from ordinary content reports. Use the impersonation route: general reports are handled by automated systems and are frequently dismissed.

Facebook

Open the fake profile, use the options menu on the cover photo and choose to report the profile, then select the option for pretending to be someone. You can report an account impersonating you, someone you know, or a business. Facebook may ask for photo identification to confirm you are who you claim; this is normal for impersonation claims and separate from your account settings.

• Report from the fake profile itself, not from a post it made — the impersonation route only appears on the profile
• If the account is impersonating your business, report it through the business route, which has different evidentiary requirements
• If you have no account on the platform, use the public form for people without an account rather than creating one

Instagram

Report through the options menu on the fake profile and select the impersonation option. Instagram distinguishes between accounts impersonating you personally and those impersonating a business or public figure, and the verification requirements differ. As with Facebook, expect a request for identification.

• Instagram will typically ask for a photo of you holding a handwritten note with a code they provide — prepare for this rather than being surprised by it
• Fan accounts and parody accounts are permitted if clearly labelled, so an account may survive a report if it declares itself as such

LinkedIn, TikTok, X and others

The pattern is the same everywhere: find the impersonation-specific route rather than the general report button, and be ready to verify your identity. On LinkedIn, impersonation reports carry additional weight where the fake profile claims employment at a real company — the company's own report can be more effective than yours.

• Where the fake account claims to work for your employer, involve your employer; a corporate report is usually processed faster
• Keep the reference number of every report — you will need it if you escalate or if the account reappears

When to file a police report — and what it needs

Impersonation alone may not warrant a criminal complaint. It changes once money, contracts or serious reputational damage are involved, and a police reference number is frequently required by banks and platforms before they will act on anything substantial.

• Report when accounts, credit or contracts have been opened in your name
• Report when the fake account solicited money from your contacts, since there are now other victims
• Report when the impersonation involves threats, sexual content or content that could constitute defamation
• Report when your identity documents were obtained or copied

The complaint needs an identifiable act, not a general grievance: the address of the fake profile and its content at the time, what was claimed and to whom, what was obtained, and any payment details involved. Attach the evidence rather than describing it — and this is precisely the material you cannot produce if you reported the profile before capturing it.

Most national police forces accept online reports for cybercrime, and several member states operate dedicated portals.

If accounts were opened in your name

This is no longer a platform problem and the platform route will not solve it. Act on three fronts in parallel, because each has its own timeline.

• Contact every institution where an account may have been opened, in writing, and ask them to record the dispute and freeze the account
• Check your entry with the national credit register — most EU member states have one, and you are entitled to see your own record
• Notify your bank even if no account has been opened there, so that the incident is on file
• Under GDPR Article 15 you may request from any organisation what personal data they hold about you, which can reveal what was submitted in your name

Keep a written chronology from the beginning: dates, reference numbers, who you spoke to. Identity theft cases are resolved through paperwork over months, and the person with a complete record fares considerably better than the person reconstructing events from memory.

If your photos are being used to defraud someone else

A common pattern: your photographs appear on a profile under a different name, used to build trust with a stranger who is then asked for money. You are not the financial victim, but you are involved and it can rebound on you.

• Report the account as impersonation — most platforms accept reports of unauthorised use of your likeness
• Capture it first regardless, because the victim may later need to prove who was actually depicted
• If a victim contacts you accusing you of the fraud, respond factually and keep the correspondence; being able to show you reported the account is valuable

You may also have a claim of your own. Unauthorised commercial or deceptive use of your image engages personality rights in most EU member states, and processing your photographs without a legal basis engages GDPR. Whether either is worth pursuing depends on the harm, but it is worth knowing you are not merely a bystander.

If the profile is already gone

Not everything is lost, though the options are narrower and none of them is as good as having captured it.

• Your own notifications, emails from the platform, and any messages you exchanged with or about the account
• Screenshots from contacts who saw it — imperfect, but several independent copies carry more weight than one
• The reference number of your report, which at least establishes that you reported an account on a given date
• Search engine caches and the Internet Archive occasionally hold profile pages, though coverage of social media is patchy

Platforms retain removed content internally for a period and can be compelled to produce it through legal process, but that requires a case already underway. It is a route for litigation, not for a first response.

What not to do

• Contacting the impersonator directly — it warns them, and the account and its content usually disappear within minutes
• Posting the fake profile publicly to mobilise reports, which spreads its reach and can expose you to a claim if you misidentify the person behind it
• Mass-reporting through friends, which some platforms treat as coordinated abuse and may weigh against your report
• Waiting for the platform before contacting your bank, when accounts may already have been opened in your name

The first is the most common and the most costly. The urge to confront is strong and it is precisely what removes your evidence.

The short version

Capture the profile in full before you touch the report button. Work out whether this is impersonation, identity theft, or both. Report through the platform's impersonation route, not the general one, and keep the reference number. File a police report where money, contracts or serious harm are involved. Contact banks and credit registers in parallel rather than afterwards. And keep a written chronology from the first day.

The whole difference lies in ten minutes at the beginning. Everything after that is administration — and administration is much easier when you can show what you are describing.

This article is general information, not legal advice. Reporting procedures, platform policies, criminal law and available remedies differ between EU member states and change over time. For a specific case, consult a qualified lawyer, your national data protection authority, or your national consumer protection body.

Frequently asked questions