Fake profile pictures: how to tell a stolen photo from an AI face

Most fake profile pictures are either a real person's photo taken without permission or a face that a generator made up. The two leave different evidence behind, so the test that exposes one will miss the other. Work out which one you might be looking at before you trust the account.

What separates a stolen photo from a generated one

A stolen photo was posted somewhere first, usually by the person in it. It sat on a public Instagram grid, a modelling portfolio, a stock library or a company's team page before it ended up on the account messaging you. That earlier life is searchable, and finding it is the whole test.

A generated face was created for the account. No copy existed before the account did, so there is no original to find, and every clue has to come from the image itself and from the account around it.

Criminals use both. In a December 2024 public service announcement, the FBI warned that fraudsters use generative AI to create "realistic images for fictitious social media profiles," and also to produce additional photos for private chats "to convince victims they are speaking to a real person." So a profile that sends you a fresh selfie on request has not proved anything yet.

Testing for a stolen photo

Start with a reverse image search. It looks for copies of the same file, including cropped and resized versions, which catches a photo lifted straight from someone's public profile.

A face search covers a gap that reverse image search leaves open. It compares the face rather than the file, so it can turn up different photos of the same person: a holiday shot on their own account, a headshot on their employer's site. That matters when a fake account uses several pictures of one stolen identity. You can check whether a profile's photos belong to someone else with FaceSearch, which returns the public pages where a matching face appears, each with a link to the source so you can read it yourself.

Read the matches for names and dates. These patterns point to a borrowed photo:

• The same face appears under a different name, especially on an older account with years of posts.
• The photo turns up in a photographer's portfolio or on a stock site.
• The same face is attached to several profiles with different names. That usually means a stolen identity being reused across a batch of fake accounts.

Treat a match as a lead, and read the page it points to before you conclude anything. People reuse their own photos across their own accounts, and those matches will carry the same name.

The limit is coverage. A face search reads only the public web. Private accounts, closed groups, messaging apps and anything behind a login are invisible to it, so a photo stolen from a private account can come back with no matches.

Testing for a generated face

Your eyes are a poor detector. In a 2022 study published in PNAS, Sophie Nightingale and Hany Farid asked 315 participants to sort faces into real and synthetic. Average accuracy was 48.2%, close to a coin toss. A second group, given training and feedback on each answer, reached 59.0%. A third group rated the synthetic faces 7.7% more trustworthy than the real ones. LinkedIn's trust team reported the same problem in June 2023, writing that most members cannot visually tell real faces from synthetic ones and that future generators are likely to leave fewer artifacts.

The visual flaws are still worth a look, because some generated images do show them. The FBI's list covers distorted hands or feet, unrealistic teeth or eyes, indistinct or irregular faces, odd accessories such as glasses or jewelry, inaccurate shadows and watermarks.

LinkedIn's researchers found a structural tell in one family of generators. When they averaged 400 profile photos made by generative adversarial networks (GANs), the result was a sharp face, because those models are trained on cropped and aligned faces and place facial features in nearly the same positions every time. Averaging 400 real member photos produced a blur. In practice, a cluster of accounts whose headshots share the same tight crop and the same eye position is worth suspicion. The same researchers found their method did not carry over to faces made with Stable Diffusion, so newer images may not have this regularity at all.

Context is a stronger signal than pixels. Ask whether the account has the history a real person accumulates: photos taken by other people, tags from friends, posts that predate the conversation with you, and a face that appears anywhere outside this one profile.

A live video call, with a request for something unscripted, is stronger evidence than any photo. It is no longer final. The same FBI announcement says criminals generate video for real-time chats in which they pose as executives and other authority figures.

Why an empty search result proves nothing

No matches can mean several different things:

• The face was generated, so it was never online before.
• The person is real and private, and has never posted a public photo.
• The photo came from a private account the search cannot reach.
• The image was too small, blurry or angled for a confident match.

An honest stranger and a fake account can produce the identical result, so an empty search sends you back to the context checks above.

A checklist for any suspicious profile photo

1. Save the largest version of the photo you can get, and crop it to one face.
2. Run a reverse image search to find copies of the same file.
3. Run a face search to find other photos of the same face.
4. If the face appears under another name, treat the account as using someone else's identity and stop sharing personal details.
5. If nothing turns up, check the image against the FBI's list of visual flaws and look at how old the account is and what it has posted.
6. Ask for a live video call, and ask for something the other person could not have prepared.
7. Report the account through the platform's own reporting tool. If money or account access is involved, file a report with the FBI at ic3.gov and include the profile links and your messages.