Account and viral-claim verification checklist

What to take away

• Preserve the account and post as they appeared when the claim spread.
• Confirm identity, current control, and post authorization separately.
• Trace copied wording and media to independent origins.
• Inspect links and requests without exposing credentials or personal data.
• Correct every surface that repeated a false identity or claim.

Use this checklist for posts, profiles, channels, group messages, screenshots, short links, and viral media. Record reviewer, time, evidence location, and result. High-risk fraud, emergency, and public-safety claims need faster escalation, not lower standards.

Preserve the object

• Post URL, profile URL, handle, display name, and account ID saved
• Text, media, link preview, timestamp, and relevant thread captured
• Badge, label, follower count, and engagement recorded with time
• Screenshot distinguished from a live or archived post
• Deleted, edited, mirrored, quoted, and embedded versions preserved
• Referral path from feed, message, search, or another post noted
• Sensitive material stored with suitable access controls

Identity, control, and authorization

• Claimed person, organization, role, and jurisdiction recorded
• Exact handle checked for substitutions, extra words, and punctuation
• Official website or directory links to the account checked
• Badge or label meaning confirmed from current platform rules
• Account history, prior names, languages, links, and contacts reviewed
• Named party contacted through an independently known route
• Account ownership, current control, and post authorization answered separately

YouTube's impersonation policy covers deceptive copying of names, handles, branding, content, and AI-generated likeness or voice, while instructing fan channels to identify themselves clearly. Platform policy can guide what to report, but a newsroom still needs its own evidence before labeling a specific account an impersonator.

Content origin and changes

• Exact text and distinctive errors searched
• Images and video keyframes reverse-searched
• Earliest available public version identified
• Creator, witness, uploader, republisher, and commentator distinguished
• Repost chain mapped with time zone normalized
• Each wording, image, crop, and link change recorded
• Independent origins counted instead of total accounts

Claim evidence

• Post rewritten as neutral, testable components
• Event, identity, place, date, number, quote, cause, and intent separated
• Original records and responsible institutions checked
• Firsthand sources' access and limits established
• Current data used for current claims
• Contradictions, uncertainty, and missing evidence recorded
• Named subject received a fair response opportunity

Links, contact, and requested action

• Short URLs and redirects inspected through safe procedures
• Domain spelling, registration context, certificate, and destination compared
• Supplied phone number or email not used as the sole confirmation route
• Request for payment, credentials, files, codes, or private contact identified
• Newsroom did not submit passwords, personal data, or verification codes
• Active phishing, malware, takeover, or fraud escalated to security staff

The FBI's account-takeover fraud alert describes criminals impersonating financial-institution staff or sites to obtain account access and steal funds or information. That pattern supports verifying contact through independently obtained institutional channels and protecting login details during reporting.

Coordination and automation claims

• Similar timing and wording treated as clues, not proof
• Shared source material and scheduled posting considered
• Common administrators, infrastructure, funding, or instructions sought
• Bot, coordinated, state-linked, paid, and malicious labels supported separately
• Platform data gaps and inference limits disclosed

Harm and publication

• Need to name or link the suspicious account assessed
• Fraud, malware, doxxing, and graphic material not amplified unnecessarily
• Faces, addresses, precise locations, and private messages reviewed for harm
• Headline, embed, screenshot, caption, thumbnail, and alt text agree
• Account status and claim status stated separately
• Safe official contact route offered when public action is needed
• Evidence and final publication versions retained

Correction and follow-up

• Account recovery, deletion, rename, or platform action monitored as needed
• Article, alert, newsletter, social copy, and partner feed included in repair plan
• Original error and corrected fact stated visibly
• New evidence logged without erasing the earlier verification record

Common questions

Does platform removal prove impersonation?

It shows that the platform acted under its processes. Seek the specific basis before describing it as a factual ruling.

Should a newsroom test a suspicious login page?

Not with real credentials. Use trained security staff and isolated procedures when technical inspection is necessary.

Can an anonymous account be a credible witness?

Yes, if access and evidence can be established and identity is known to an accountable editor when risk warrants it.

What if the account is real but the post is wrong?

Report the account as authentic and verify or correct the claim independently. Do not turn identity into a truth rating.