How to check an unfamiliar account and viral post

What to take away

To verify a social media account and a viral post, start with evidence rather than recognition: an urgent post from a familiar logo can make the reader see the mark and skip the handle. The same message can come from a new impersonator, a real account that has been taken over, a copied screenshot, or a genuine account that made a mistake. Which one it is decides what you publish.

Save the post before you touch it

Capture the post and profile URLs, the handle, the display name, the account identifier, the timestamp and the media. Note the follower count, any badge, the replies that matter, and how the post reached you. Screenshot it and save the page the way your newsroom policy requires.

Do not open a shortened or suspicious link in your everyday browser. Do not call the number or email the address in the post to ask whether the post is real. That hands control back to the possible impersonator.

For a fast-moving post, preserve evidence first, confirm identity and current control independently, trace the media, and verify the claim against a primary record. The viral claim verification guide is a related resource; those are the steps to follow here.

Compare the claimed identity

Find the person or organization somewhere the account does not control: a website, a licensing or corporate filing, a staff directory, an old press release, or a switchboard number. Look for that source linking out to its own social accounts, then compare handles character by character, checking punctuation, doubled letters, added words, and lookalike Unicode characters. For companies, search the relevant state's Secretary of State business-entity database; for a claimed tax-exempt charity, use the IRS Tax Exempt Organization Search. For a professional license, search the relevant state licensing board's public register; a matching record supports the claimed identity but does not prove who controls the social account.

Read the account's history. On X, check the profile's Joined date; on Facebook, inspect Page Transparency for the page's creation date and name changes; on Instagram, check About this account when available. Record what the platform actually displays, since features and fields can vary. A new account is not automatically false, and an old one is not automatically safe. Old accounts get sold and taken over.

Name the account type

Sort the candidate into one of these before you write anything:

Then contact the owner through a route published earlier, such as a switchboard number, a website form, a known email or a representative. Ask whether the account and that specific post are authorized.

An independent website linking to the account supports affiliation; a badge reflects the platform's status process, and neither it nor a long history proves who controls the account now. The identity signals comparison covers what each kind of signal does and does not prove.

Read the message without following it

Write down the action the post requests in one line. Then inspect the expanded destination through your newsroom's safe-browsing process on a spare device; do not open a suspicious shortened link on your everyday device. Use ICANN Lookup for available domain-registration (WHOIS/RDAP) data and crt.sh to search for TLS certificates issued for the domain. Compare spelling, registration details, redirects, certificates, and page branding with the organization's independently located site; none of these signals alone proves affiliation.

The FTC's business impersonator scam guidance describes the pattern: an unexpected message imitates a known company, invents an account problem or a prize, and pushes the reader to a supplied link or number. Contacting the company independently is both the safer move and the identity check.

CISA's page on recognizing phishing lists the signals worth logging: urgency, a threat of consequences for not replying at once, a request for personal or financial details, a shortened link from an untrusted sender, and a near-miss address. Record each one as an observation, not an impression.

Never type credentials or personal details into a page you are checking. Hand malware, credential theft and active fraud to security staff and the platform.

Trace the post and its media

Search the exact wording, including any distinctive typo, in Google Search and Google Fact Check Explorer to find earlier reporting or fact-checks. Reverse-search the image with Google Lens or TinEye, and use InVID-WeVerify to extract video keyframes for comparison. Compare timestamps and edits, and use the Internet Archive's Wayback Machine to inspect archived versions of public pages; an old capture can help trace a page but cannot authenticate an account.

Keep a chain table: account, time, what changed, what evidence was added, where the link points. A repost that turns "may close" into "is closed" has created a new claim. Check that version on its own.

Worked example (hypothetical): An unfamiliar X account claiming to represent a county emergency office posts an evacuation order with a road-closure photo. Save the post and profile, compare the handle with a county website found independently, check X's Joined date as a clue, and contact the agency through its published switchboard; run the photo through Google Lens or TinEye and search the wording for earlier fact-checks. Verify the order against the agency's current notice, not a search result; if the agency does not confirm the account or order, report both as unverified.

Check the claim underneath

Go to the record, not the speaker. An evacuation claim needs the current order and the agency that issued it. A recall needs the regulator and the manufacturer notice. An investment pitch needs the registration and the filings. A quotation needs the full recording.

Ask the named party for a response and for a public contact readers can use. If control of a real account is in dispute, leave out the private recovery details. Those details help the attacker more than the reader.

Publish what you confirmed

Give the handle exactly as it appears, but do not build a clickable path to live fraud unless the public interest clearly outweighs the risk. Before publication, work through this checklist:

The verification checklist is a related reference; the items above are the checks to complete before publication.

Plan the correction in advance. If the account changes hands, deletes the post or recovers from a takeover, you may need updates. Update the article, the embed, the screenshots and the push alert. Also update the newsletter and any partner feed.

Common questions

Is a typo in a handle proof of impersonation?

No. It is a strong reason to compare the account against independent official channels and to ask the named party directly. Plenty of real accounts have odd handles.

Can a real account be hacked?

Yes. A long history and a genuine badge say nothing about who holds the account today. Treat the current post as unverified until the owner confirms it through a separate route.

Should I message the suspicious account for proof?

You can ask questions without sharing anything sensitive, but that conversation cannot confirm identity. Get confirmation through a route you found independently.

Is deleting the post evidence of guilt?

No. Posts come down for many reasons, including embarrassment and routine cleanup. Preserve what you saw and ask for an explanation without assuming a motive.