An examination of foreign American-impersonating Facebook accounts posting political content

Update May 8, 2018: my Facebook work was mentioned in this November 2017 NY Times article, and in this May 2018 Washington Post article. I’ve also written a popular piece on how to spot fake Facebook accounts. Here’s a piece on something anyone can do to help fight American-aimed fake news and lies.

I’ve spent a good amount of time studying fake Facebook accounts. My initial interest in this subject came about because I was in a pro-Trump Facebook group (at time of writing 43,500 members) and was shocked by how many fake news websites were shared in the group. Many of these were clearly Macedonian in origin and many more were probably Macedonian; I wrote a piece about this, focused on the clickbait websites themselves.

I wrote that piece linked above in mid-June 2017. Now, in September, there are still a massive amount of obviously non-U.S. accounts posting in and websites being shared in that same pro-Trump group. On some days recently, a majority of the posts in that group were made by fake-American accounts or non-U.S.-based accounts. Update Sept 2019: in some groups, the administrators themselves are foreign American-impersonators.

In this piece I’ll show some examples of these fake-American Facebook accounts with the goal of educating others to the phenomenon and hopefully helping others more easily identify fake social media accounts on their own. Along the way, I’ll identify some of the ways you can tell that an account is almost certainly fake, and I’ll give pictures of fake Facebook accounts I’ve found.

If you’re not aware, it’s well-known that Macedonia produces a lot of fake news aimed at the conservative U.S. population. I have some links to more information about this at the bottom of this piece. Suffice it to say: I am not an expert on the underlying causes of this phenomena; this article is just intended to share what I see and to spread the word, and also to help others recognize similar activity.

This will focus on the fake U.S.-resident accounts; these are the accounts that:

• Are clearly or almost certainly not U.S. residents but have account details claiming to be U.S. residents
• Use account pictures pulled from actual people’s accounts/profiles or from random websites

Okay, let’s look at some accounts.

“Isabelle Jaden”

On September 3 2017, “Isabelle” shared a post (pic below) in a pro-Trump Facebook group. She has shared several posts in this Facebook group, and it’s fair to assume she is sharing more posts in other groups.

Also note that the websites shared by these fake accounts are low-quality or obviously-fake news sites; most of these were probably produced in Macedonia.

Here are some of her profile details, showing her saying she lives and works in Illinois.

In August, you can see that she uploaded pictures of her “family”:

But the profile URL for “Isabelle” looks like this:

In Facebook, you can change your displayed profile name, but often there will be an original name visible in the URL. (Some accounts just have numbers in the URL so this is only a possible clue of deception on some accounts.)

And when we look before her “family” pictures upload in August, we find posts like these:

Here is what this account’s friends list looks like:

Okay, you get the idea.

Next:

“Altheda Alyx”

“Altheda” has been a frequent poster in the pro-Trump Facebook group I’m in. A couple examples of what she’s posted:

Her Facebook bio shows that she lives in New York and works for the Yankees:

Note she also manages a pro-Trump Facebook group. (This last detail doesn’t mean much; often Facebook group administrators will create a group and just give out admin/moderator privileges to anyone who seem like-minded. My wife was once made moderator of a pro-Trump group after being in it for just a few days.)

Going through her old posts, we see this person uploaded their cover photo in July of 2017:

In August the account changed their work and education details:

Before July, though, her feed has posts in the Hindi language:

There are almost no posts in English before July 2017. There are many Hindi language posts and also many spam-looking posts promoting something called Bigo Live:

The account’s URL is ‘jinamod’:

A post from March says she was with this friend:

Looking at the Ansari account shows that she lives in Rae Bareli, a city in India.

Looking at one of this account’s old posts, these are some of the Facebook accounts who liked her post:

With this account’s rebirth as a pro-Trump American account, though, and presumably with her being manager of a pro-Trump Facebook group, her Friends list has grown to include many actual conservative Americans:

Finally, below are just a few (maybe 1/5) of the pro-Trump/rightwing Facebook groups this account is a member of.

Moving on…

“Elizabeth Mason”

Here’s one of several posts from “Elizabeth” in the pro-Trump FB group:

Here’s her account details:

Here’s her profile URL:

Here are a look at some of the recent Facebook groups she’s a member of:

Scrolling farther back in the groups, though, we find different kinds of groups:

Also interesting: in the ‘Cute Girls’ group, the previous account we looked at, Isabelle Jaden, is also a member of that one.

Moving on…

“Elizabeth Tatishvili”

This is one of the fairly common Macedonian fake accounts. Below you can see some of the details of the account, including that she lives in New York, studied at Harvard, and works at CNN. (The CNN is probably an amateur mistake of not knowing your audience: I saw one of her pro-Trump friends comment “CNN Why?”)

Using Google Search I found that her profile picture is actually a picture of the actress Margot Robbie:

Her friends list is a mix of seemingly real U.S. citizens and also some obviously fake accounts (with a little bit of research) with strong, simple “American” names like Eliza Rockefeller, John Smith, Bela Smith, Frank Rice, John Lewis, John Dickson.

Here are just a few snapshots from the accounts of some of the “friends” in this fake-account network partially pictured above:

“Eliza Rockefeller” uses a picture of actress Jennifer Lawrence, and you can see some Macedonian language in the account:

“John Ruth” uses a picture of Goldie Hawn and Kurt Russell. (Also interesting: many in this network of Macedonians using celebrity images can be found to have posted that “#NBAVote Zaza Pachulia” post, visible in the previous and the following images. Pachulia is an NBA basketball player born in the country of Georgia.)

Here’s “Frank Rice.” His account has very little public. Interestingly, one post shows him posting from a location in the Phillipines. (Again, these details don’t necessarily mean much about who is using the account now. This is the third Philippines-associated Facebook account I’ve seen.)

“Diane Worsham”

Another Macedonian fake-American account calling itself “Diane Worsham”:

This one was interesting because I was able to use Google image search to find the picture of the woman they stole the image from on a California company’s employee website page. Her name is not Diane Worsham.

What are some clues the account is Macedonian? Here’s an old post on this account’s feed:

And here’s a list of Facebook friends who liked an old post:

“Harry Taylor”

This one was also kind of interesting because I was able to track down the real person they’d stolen the picture from. This is the fake Harry Taylor account:

Here’s an example of the kind of thing he’d post in the Facebook groups:

Here are some old posts of his:

There is a real Harry Taylor in Lynchburg Virginia, and this is who they stole the picture from. Interestingly, they chose to keep both his actual name and his actual location. The strategies for creating fake accounts, as we’ve seen, vary a lot.

Interestingly, there are many ‘Harry Taylor’ fake Facebook accounts. Here’s a result of a search on Facebook for ‘Harry Taylor’:

It doesn’t speak highly of Facebook’s security that multiple accounts with the same name, image, and location are not flagged as suspicious. This was one of the few searches for a specific name I did on Facebook so it’s possible there are many duplicate accounts for many names and pictures used by fake accounts.

Brother and sister Facebook accounts

One of the more in-depth attempts at strategy I’ve seen is to have accounts interact in more complex ways, like this brother-sister act by a couple fake accounts. These were pretty convincing on the surface and I had to do a little work to feel confident that these were fake accounts. Some accounts do more fake-photo posting and more “world-building,” making it take more work to be confident they’re fake.

An account named “Alaxander Frost” posted in the pro-Trump group. His account looked fairly convincing on surface. Only potentially strange flags: no friends are made public, and only a few public posts. Of the posts made public, they look legit, like this one, where he says he’s visiting his sister, Tina Peak:

You can see Tina responding in the comment of this picture.

Let’s look at Tina’s account:

Tina’s account is also pretty convincing on the surface. Lots of pictures of friends. But when you look at the details they become a little more suspicious. For one thing, when you look at the likes on the photos, they are all Eastern-sounding names. Not that this is suspicious in itself, but it doesn’t exactly jibe well with the general feel of the pictures or the fact that this is a person in many pro-Trump groups:

Also, when we look at the Facebook groups this account is in, and we scroll back past all the Trump-related groups, we find these initial groups:

Networked accounts, and accounts that use same real people’s pics and names

There are also accounts that steal the names and pictures of real Facebook accounts. (Update: for more context on these accounts, see this NY Times piece about the social media black market.) In my database, I have dozens of examples of these accounts, which seem to prefer to use young female accounts, presumably because those identities get more attention from men.

These fake accounts are sometimes networked together. Many of the accounts like each others’ posts, as a way to increase the realism of the fake accounts. (One of the clues of fake accounts is when you go back to their earliest content and find the same accounts all liking each others’ stuff.) Interestingly, the fake account networks steal the photos/names from actual, real networks of friends. I have several instances of fake accounts that have used the identities of a group of real Facebook friends.

For privacy reasons, I won’t share screenshots of these examples, as they are names and pictures of real people. I’ve notified the real accounts I was able to identify. Reporting these fake accounts gets very little result from Facebook; despite reporting dozens of these, many still remain active. But having the real account report their doppelganger gets more traction; those accounts reported by the real person are taken down quite quickly.

Content not associated with websites/clicks

Most of the content posted by fake rightwing accounts is associated with websites. This is true of most of the posts we’ve looked at in this article. And this fits into the prevalent theory that Macedonians are merely trying to make money by driving traffic to ad-laden websites. (Here are a couple articles talking about this phenomenon in Macedonia: Wired article, Buzzfeed article. Also helping support the idea that there is a lot of money in fake news, here’s an NRP article from an American citizen fake-rightwing-news maker.)

But combatting this idea is the fact that often fake accounts post content that is not associated with any website, so is not directly linked to making money. Here’s an example of this below. Notice the large number of likes.

And here’s this fake account’s “American” details:

And here is this account’s URL:

Of course it’s possible these accounts are playing a more long-game con in trying to appear like legitimate accounts and get more friends and get people to look at their content on their wall. But you would think that most “bang for the buck” in putting content in these groups is driving people to websites and generating clicks. That is the standard strategy. Considering this post got 3,000+ reactions, it seems unlikely that a fake account would “waste” those eyeballs and possible clicks and income on such a long-game, speculative strategy.

In conclusion

The most important question about this activity is: it more nefarious than just a money-generating scheme? Is it related to the Russia manipulation of the U.S. election? Is it related to some other rightwing agenda? I don’t pretend to have enough information to determine that. For further reading, though, I suggest a couple articles that at least suggest the possibility that the Macedonian fake news production is more nefarious than just profit-motivated:

• Guardian article: this mentions the idea that Russia could have had a hand in instigating Macedonian fake news production.
• OCCRP article: talks about how Macedonian rightwing forces influenced U.S. rightwing to aid them in an anti-Soros campaign.

It seems a trifle naive to believe that all of this very biased and hateful and divisive content would be produced and distributed solely for monetary purposes, as there are obviously many topics to create clickbait for.

I find myself thinking about what I would do if I were Russian strategists trying to conceive a sustainable effort to produce ongoing destabilizing propaganda like this: propaganda that would be both sustainable and for which Russia could plausibly deny responsibility. I think it makes strategic sense that you would try to instigate a system where a region, with both a lot of poor people seeking occupation and also with widespread rightwing sentiment, was incentivized to produce such propaganda. With the right groundwork and manipulation, you could create a large self-sustaining industry of people who realize they can make money off of making extreme and divisive political content, driving traffic to that content, and selling ads.

Of course, that could have happened organically on its own, and that seems to be many people’s opinion. But when considering the Russian manipulation of social media and specifically Facebook accounts, it seems at least plausible that Macedonian content is related in some way to Russian manipulation.

Regardless of the underlying origin, the result is the same: many Americans consuming fake and/or divisive news and propaganda that drives a wedge between those people and more reasonable, informed Americans and makes it more difficult to all get on the same page and make compromise. (Keep in mind in many of these rightwing Facebook groups at this point in time, this fake/divisive content makes up the majority of content.)

Update 11/3/17: For sake of completeness, I wanted to mention: At the time of writing this article, I’d only seen rightwing fake accounts. Since then, I have seen some fake accounts posting anti-Trump content in anti-Trump groups. But based on a quick examination, the liberal/anti-Trump content seems much less common than the rightwing fake accounts. Whether that’s due to a philosophical cause, a financially-motivated cause, or because there’s plenty of genuine anti-Trump sentiment to go around, is not something I have insight into.