Fake Profiles and Identity Theft on Social Media: How to Respond and Hold the Responsible Party Accountable

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Discovering a fake profile that uses your name, your photos, or your company’s identity to deceive others calls for an immediate, organized response. Victims need to preserve evidence, report the account to the platforms, and, when necessary, take the case to court to have the content removed, identify the person behind it, and seek compensation. Knowing each step improves your chances of stopping the scam before it causes greater harm.

How to Recognize Identity Cloning on Social Media

Digital identity cloning happens when someone creates a profile that poses as a real person or a company, copying the name, profile photo, logo, bio, and even the history of posts. The goal is usually to deceive the victim’s contacts, ask for loans, offer products that do not exist, or run financial scams in the victim’s name.

A fake profile is not the same as a hacked account. With a fake profile, the criminal opens a new account that imitates the victim. With a hack, the criminal takes control of the real profile. The legal measures are similar, but a hack is even more urgent, because the offender is speaking directly to the victim’s genuine network of contacts.

The first warning sign usually comes from other people. Friends, clients, or relatives report strange messages, requests for transfers, or suspicious offers. The sooner you spot the problem, the less damage is done, since the scam feeds on the trust people place in the name being copied.

Gather and Preserve Evidence Before the Content Disappears

Evidence is the heart of every step that follows. Fake profiles can be removed, edited, or deleted by their creators at any moment, and anything you have not recorded will rarely be recovered. That is why, even before you file a report, you should document everything carefully and in chronological order.

Take screenshots of every relevant element: the profile photo, the username, the full page address, the posts, the comments, and above all the conversations in which the impostor pretends to be you. Also record the date and time of each capture, since these details help prove the sequence of events.

Whenever possible, save the exact web address of the profile, normally visible in the browser’s address bar. That address, together with the account’s numerical identifier, is what allows the court to locate the person responsible through the platform. Keep the original files, uncropped and unedited, in a safe place.

In cases with greater visibility or higher stakes, it is worth recording the evidence in a notarial record (ata notarial) drawn up at a notary’s office. The notary accesses the content and describes what he or she sees, giving the material public faith. This document carries extra weight in court and reduces disputes over possible tampering with the screenshots.

Also collect the accounts of people the scammer approached. Messages received by your contacts, receipts for transfers made by mistake, and screenshots of conversations sent by third parties all add to the body of evidence and show the concrete harm caused by the fraud.

That is why, even before you file a report, you should document everything carefully and in chronological order.

Request Removal and Identification of the Offender

Once you have the evidence in hand, the next step is to contact the platform itself. Social networks maintain specific channels for reporting accounts that impersonate another person or brand. You fill out the form, attach an identity document, and describe the fraud. Many removals happen this way, with no need for a lawsuit.

When the company is slow or refuses to take the profile down, or when you need to find out who is behind the account, the courts come into play. Your attorney can request, on an urgent basis, the immediate removal of the fake profile and the release of the registration and access data linked to that account.

It is important to distinguish between the two requests. Removal stops the scam and protects your network of contacts. Identifying the offender makes it possible to hold that person liable in both civil and criminal proceedings. Generally, removal is faster, while identification depends on a court order directed to the platform and, often, to the internet service provider.

Prevention matters too. Companies and professionals with a significant social media presence should register their trademarks, verify their official accounts, and advise clients to be wary of requests for money or personal data made by message. These measures reduce the impact of a possible cloning and make the fraud easier to prove.

The Crimes Involved in Creating Fake Profiles

Creating a fake profile to deceive others is not merely abusive conduct; it can amount to several crimes. False identity, provided for in Article 307 of the Brazilian Criminal Code, punishes anyone who attributes to themselves or to another person an identity that does not match reality in order to gain an advantage or cause harm to someone.

When the scammer misleads the victim or the victim’s contacts in order to obtain money or property, the crime of fraud (estelionato) under Article 171 of the Criminal Code comes into play. If the unlawful advantage is obtained through electronic devices, messages, or social media, the offense of fraud committed in a digital environment applies, with an increased penalty.

Offenses against honor also appear frequently. Posts that falsely accuse the victim of a crime can amount to slander (calúnia). Statements that damage the victim’s reputation constitute defamation (difamação), and direct insults constitute insult (injúria). These conduct types are set out in Articles 138 to 140 of the Criminal Code and also allow for compensation in civil court.

There is also the violation of image rights and of the processing of personal data. Using someone’s photos and name without authorization violates the protection of personality rights set out in the Civil Code, and improper collection of data can lead to liability under Brazil’s General Data Protection Law.

Given all this, the victim can file a police report, file a criminal complaint against the offender once identified, and, at the same time, bring a civil action to demand compensation for the moral and material damages suffered. These measures complement one another and can proceed at the same time.

The Platforms’ Duty to Provide Data Under a Court Order

Platforms are not automatically liable for content that third parties post, but they have clear duties when they are called upon. The Marco Civil da Internet (Brazil’s Civil Rights Framework for the Internet), Law 12.965 of 2014, provides that providers must keep access logs and can be required to hand them over under a reasoned court order.

These records include registration data, the connection addresses used to create and access the account, and the time of each access. With that information, it is possible to reach the offender’s internet provider and, through it, the actual person responsible for the fraud, completing the path to identification.

The law also addresses the platform’s liability for content. As a rule, the company is civilly liable only if it fails to remove the material within the set deadline after a specific court order for removal. That is why the decision ordering deletion must clearly indicate the address of the content to be removed.

The confidentiality of communications and data is protected, and lifting it requires court authorization. This balance seeks to protect the privacy of legitimate users while ensuring that victims of fraud have an effective way to identify and hold accountable those who act behind a digital mask.

Keep in mind that these records are retained only for a limited time. The longer a victim waits to seek a court order, the greater the risk that the information will no longer be available. Acting quickly, backed by well-organized evidence, is what makes this whole set of measures effective.

Frequently Asked Questions

Does reporting the fake profile directly on the social network solve the problem?

In many cases, yes. A report through the platform’s official channels can lead to the removal of an account that impersonates another person or company, especially when accompanied by an identity document. Even so, an internal report does not identify the offender or guarantee compensation. When removal fails, or when you want to hold the responsible person accountable, going to court becomes essential.

Is it possible to find out who created the fake profile?

Yes, with a court order. The court can order the platform to provide the registration data and access logs linked to the account, such as the connection addresses used. From that information, investigators can reach the internet provider and then the person responsible. Success depends on well-preserved evidence and speed, since these records are kept only for a limited time.

Am I entitled to compensation for being a victim of cloning?

As a rule, yes. The improper use of your name, image, or brand, together with the offenses and losses it caused, supports a claim for compensation for moral damages and, where a financial loss is proven, for material damages as well. The amount is set according to the seriousness of the case, the extent of the exposure, and the losses demonstrated. The civil action can proceed alongside the criminal complaint.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.