Toàn văn hướng dẫn này hiện chỉ có bằng tiếng Anh.
Preserve first, investigate second
Before you analyse anything, capture it: full-page screenshots with the URL bar visible, the account creation date if shown, the profile photo, and a log of messages with timestamps. Accounts disappear the moment their owner suspects attention.
Do not engage while you collect. A message from you tells the operator which of their identities you have already found.
Harvest the identifiers you have
A fake account usually leaks something in the way it was made: a reused profile photo, a handle that matches a real person's, a bio copied from another profile, or a posting pattern that reveals a timezone and a sleep schedule.
Run the handle and the photo separately. The photo often resolves to the real person being impersonated, which reframes the case: you may be dealing with identity theft rather than an invented identity.
Distinguish impersonation from invention
An account using a real person's photos and details is impersonation, and it is usually against the platform's rules in a way that gets acted on. An account with invented details is harder to attribute and usually needs behavioural evidence instead.
For impersonation, the fastest legitimate route is the platform's impersonation report with your evidence — it does not require you to identify the operator at all.
Avoid misidentifying an innocent person
The most common failure in amateur attribution is matching a handle to a real person who simply uses the same string. Common handles belong to thousands of people.
Only name someone when evidence the account published points at them: a linked personal page, a reused photo from their own account, a self-reference. Circumstance is not identification, and acting on a wrong attribution causes real harm.