The Old Catfishing Advice Stopped Working. Here's What Replaces It.

For about a decade, the advice for working out whether someone online was real came down to two moves.

Run their photo through a reverse image search. If it shows up on sixty other profiles, you are done.

Ask them to hop on a video call. Scammers will not do it, so refusing is your answer.

Both of those were genuinely good advice. Both of them are now substantially broken, and a lot of safety guidance has not caught up.

Why reverse image search stopped catching people

The old scam worked by stealing photos. Someone lifted a model's Instagram pictures, built a profile, and the pictures existed elsewhere on the internet. Reverse image search found them because the image had a history.

A generated face has no history. It has never been posted anywhere, because it did not exist until the moment it was made. You can produce a consistent person, same face across twenty photos, different angles, different lighting, holding a coffee, at a wedding, in a gym mirror.

Searching for that image returns nothing. Which, to anyone following the old advice, reads as confirmation that the person is real.

That is the dangerous part. The check does not fail loudly. It fails by returning a clean result.

Why the video call test is weaker than it was

The second piece of advice held up better and for longer, and it still has value. But treating it as proof is no longer safe.

Real-time face manipulation is no longer a research demo. The quality varies and a long, well-lit, unscripted call is still hard to fake convincingly. A short, dim, laggy call is not.

And notice how the scam adapts: the pressure is always toward a brief call with a bad connection. Camera angle slightly off. Poor lighting. "Sorry, my wifi is terrible." You get thirty seconds of a face, your guard drops, and the verification you think you performed was mostly performed by you.

This is also showing up in the worst category of this crime. Reporting through 2026 has described offenders using AI to generate sexualised images of people in order to threaten them, a pattern safety organisations describe as financial sextortion, where the attacker poses as a peer to obtain or fabricate material and then demands money.

The numbers are worse for younger users, not better

There is a persistent assumption that people who grew up online are harder to fool. The data does not support it.

Across reported online scam losses, the highest rate of money loss sits with 18 to 29 year olds, at around 26%, higher than older groups. And in surveys of teenagers, about 45% said they accept friend requests from strangers, which is the single behaviour that opens the door.

Being comfortable with technology is not the same as being suspicious of it. If anything, fluency makes people quicker to trust an interface.

Sources: catfishing statistics overview and guidance on spotting scams and catfishing.

What still works: behaviour, not pixels

Here is the shift in thinking. Stop trying to verify the image. Start reading the behaviour, because that is the part a scammer cannot fully automate and the part that has not changed in ten years.

The underlying economics are the same as they always were. A scam account needs to move a large number of targets toward money quickly. That requirement produces a recognisable shape, regardless of how good the photos are.

1. The pace is wrong. Real friendships are slow and uneven. People get busy, reply late, forget what you told them. An account that is intensely available, replies instantly for hours, and escalates intimacy fast is following a script. Genuine warmth at an unnatural tempo is the single most reliable signal we see.

2. The conversation avoids specifics. Ask about the place they said they live. Not a quiz, just a normal question: which part, what is around there, how long. Fabricated lives are thin on texture. They answer in generalities and steer back to how they feel about you.

3. They remember your details but not their own. Scam operators work from notes about targets. They will recall your sister's name and then contradict something they told you about themselves three days ago. Inconsistency about their own story, combined with excellent recall about yours, is a strong pattern.

4. There is a reason you cannot meet or call on your terms. Not a flat refusal. A sequence of plausible obstacles. Working offshore, travelling for a contract, phone broken, in a different time zone this month. Any single one is normal. A chain of them is the thing to notice.

5. Money appears as a crisis, not a request. Nobody competent asks for money. A situation develops: a stuck payment, a medical bill, a customs fee, a brilliant investment closing today. You are invited to solve a problem rather than grant a favour. If a conversation that started socially arrives anywhere near money, that is the end of the conversation.

The rule I would actually give someone

If I had to compress this into one thing, it would not be about detection at all.

Never let the relationship outrun the verification. Whatever you are confident about should lag behind what you have actually confirmed over time.

That means: no money, ever, to anyone you have not met in person, regardless of how long you have spoken or how certain you feel. No intimate images, to anyone, at any point, because the threat model there is not just scammers. And no moving the conversation off a moderated platform early, because that is almost always step one, and it exists to remove the reporting and blocking tools that protect you.

On our side, moderated environments and reporting tools catch a meaningful share of this before users ever see it. That is genuinely useful, and it is also not sufficient on its own. The accounts that get furthest are the patient ones, and patience is hard to detect automatically. Your own sense that the tempo feels strange is doing more work than people give it credit for.

If it already happened

Two things, in this order.

Stop responding immediately. Not a final message, not an explanation. Scripts are designed to re-engage you, and any reply restarts the clock.

Then report it, to the platform and to the relevant national reporting body. People skip this because they feel stupid, and that shame is precisely what the scam relies on to stay profitable. You were targeted by someone doing this professionally, at scale, with tools that did not exist three years ago. That is not a failure of intelligence.

If images are involved and the person is under 18, that is a criminal matter and should go to law enforcement rather than being handled alone.

See also: how to spot a fake profile in a chat app and signs someone wants to be your friend.

Frequently asked questions

Does reverse image search still work for spotting fake profiles?

Only against the older style of scam that reuses stolen photos. AI-generated faces have never been posted anywhere, so the search returns nothing, which can be misread as proof the person is genuine. Treat a clean result as neutral, not reassuring.

Can I trust a video call to prove someone is real?

Partially. A long, well-lit, unscripted call is still difficult to fake convincingly. A short, dark or laggy call is not, and scammers push toward exactly those conditions. Treat a brief call as weak evidence rather than confirmation.

What is the most reliable warning sign now?

Tempo. Accounts that are constantly available, reply instantly for hours and escalate closeness quickly are following a script. Real friendships move unevenly, with gaps and forgetfulness.

Are young people safer because they grew up online?

No. Reported losses to online scams are highest among 18 to 29 year olds, at roughly 26%. Familiarity with technology tends to increase trust in interfaces rather than suspicion of them.

What should I do if I think I am being scammed?

Stop replying straight away without explaining why, then report the account to the platform and to your national reporting body. Do not send money or images. If the person involved is a minor, contact law enforcement.