How to investigate a Twitter account or suspicious tweets

We’ve made a list of some helpful tools, as well as some plain old good advice, for investigating content on Twitter and identifying fake accounts or tweets.
We’ve made a list of some helpful tools, as well as some plain old good advice, for investigating content on Twitter and identifying fake accounts or tweets. © Observers

There are about 200 million people who use Twitter on a daily basis, making it an important site for news and information. But this social network is also a prime source of disinformation, from fake accounts to tweets taken out of context. The FRANCE 24 Observers team takes a look at some good habits to avoid falling into these Twitter traps.

Advertising

What to do when you are looking at an unfamiliar Twitter account 

When you see a suspicious post on Twitter from an unfamiliar author, here’s where you should start:

  • First, check to see if the account is certified. In that case, the person will have a blue badge next to their name (but, remember, this alone isn’t enough to earn your trust because this, too, can be doctored). 
  • Check the account’s name to see if there are misleading upper or lower case letters (for example, a capital "i" looks very similar to a lowercase "l")
  • Read the account bio. Sometimes the bio will explain that the account is a parody and not the real thing
  • Examine the profile picture (we have info below on how to spot a fake profile picture) 

If you are wary of an account, you can also analyse its activity using free tools such as Foller.me or Botometer.

These two tools can give you information on an account’s activity and can even let you know if an account seems to be fake or run by a robot. 

We used Botometer to analyse the Twitter account of our Observers journalist @alexcapron. The tool said that it looks like a real account and doesn’t seem to be acting like a robot.
We used Botometer to analyse the Twitter account of our Observers journalist @alexcapron. The tool said that it looks like a real account and doesn’t seem to be acting like a robot. © BotoMeter

In February 2022, several Twitter accounts made to look like they were affiliated with the American channel CNN shared false information.  

These accounts used the American news channel’s logo and had handles that looked like they could be official: @CNNUKR and @CNNAfghan. They were used to spread an unfounded rumour about the death of an American journalist in Ukraine. 

This is a screengrab of tweets containing false information shared by accounts falsely claiming to be connected to CNN. The person in the photo is actually someone named Jordie Jordan, an American YouTuber.
This is a screengrab of tweets containing false information shared by accounts falsely claiming to be connected to CNN. The person in the photo is actually someone named Jordie Jordan, an American YouTuber. © Observers

However, these two accounts don’t have the Twitter certification, unlike official CNN accounts like @CNN or the regionally specific @cnnphilippines. CNN has, by the way, reported these two fake accounts, which have since been suspended (check out this article by our fact-checking colleagues at French news agency AFP here). 

It’s important to get into the habit of verifying a Twitter account that looks like a media account but doesn’t have the Twitter certification badge. Watch out because some accounts use the “✔️” or "✅" emoji to make it look like they are certified. However, the true Twitter certification looks like a little medallion next to a user name. It’s either blue or white depending on your version of Twitter (light or dark background). 

If an account doesn’t have this certification, then you need to be careful. However, not having the certification doesn’t necessarily mean that an account is fake – for example, it could be a media with a small audience or a new media outlet that hasn’t finished the certification process.

Digitally altering a tweet

Most “fake tweets” circulating online are screengrabs that have been digitally altered.

There are a few methods, available to all, to create fake tweets, which are sometimes very realistic. 

Some tweets are modified using software like Photoshop. You can sometimes identify these tweets if you inspect the font and the number of characters used because, very often, they are different from the Twitter standards.

Here’s an example of a fake tweet made to look like it was shared by the BBC. The tweet is about Emmanuel Macron, whom it claims announced that “60 million refugees” will be coming to Europe.  

If you look a bit closer, then you’ll see that the text is outlined with a colour that is slightly different to the background. Moreover, the number of characters used surpasses the 280 authorised by Twitter.

We scrolled through the BBC’s Twitter feed and found a tweet from the British channel that has a similar image and was shared at the same time. However, the content has nothing to do with refugees, as you can see below. 

We placed the two tweets side by side to compare them. The real tweet, outlined in red, is on the right.
We placed the two tweets side by side to compare them. The real tweet, outlined in red, is on the right. © Observers

The BBC also denied that it put out this tweet. 

Another example is this tweet falsely attributed to CNN about a secret Chinese document that predicts that multiculturalism will cause the downfall of the west. 

A fake screenshot of a tweet that circulated online.
A fake screenshot of a tweet that circulated online. Observers

This tweet does, of course, have a certification and CNN’s real handle. However, you can see that the text has a light outline in grey and the number of characters used, 302, surpasses Twitter’s 280 character limit.  

Modified source codes

Doctoring an image using Photoshop or another tool isn’t the only simple way that someone can modify a tweet. 

You can also change the text of a tweet by modifying the page’s source code. If you do this, then you can change the contents of a tweet on your screen, but you can’t save these modifications. 

However, once someone has modified the text of a tweet, then they can take a screengrab of the image, which they can then share on social media. The modified tweet looks very real. 

Below, we’ve demonstrated how you can modify the source code of a publication on our Twitter account (@Observers).

On the left, you can see the original tweet from our Twitter account, as well as the source code (below). On the right is the modified tweet, which we edited by changing the text in the page's HTML source code.
On the left, you can see the original tweet from our Twitter account, as well as the source code (below). On the right is the modified tweet, which we edited by changing the text in the page's HTML source code. © Observers

Moreover, there are actually sites online where you can generate fake tweets. You just type in a user name, upload a profile picture and choose a time. You can even add a verification badge if you like. You can’t share these directly on Twitter but, again, you could post a screengrab of the image. 

How to verify

There are a few ways that you can detect these fake tweets. First of all, you can check if the suspicious tweet actually did appear on the Twitter feed of the account that supposedly published it or not. 

Let’s take this example of the tweet falsely attributed to the BBC that was circulating on Twitter in late May.

A  tweet sharing a screenshot of a fake tweet.
A tweet sharing a screenshot of a fake tweet. Observers

You can see the verification badge on this screengrab. The username matches with an official BBC Twitter page, “@BBCWorld”. To check if the outlet has indeed posted this tweet, we can run the keywords that appear in the tweet through an advanced search on Twitter.  

For example, you can type this into the Twitter search bar: [“Saudi” AND “Pride” (from:BBCWorld)]. The “AND” indicates that we want to look for tweets featuring both of these two keywords. The (from:BBCWorld) establishes that we only want to search for tweets shared by this particular BBC Twitter account. 

This is a screengrab showing the result of the search on Twitter.
This is a screengrab showing the result of the search on Twitter. © Observers

It turns out that no tweets using these two words come up in this search. You can use the same method to see any tweets shared by that BBC account featuring the words “Saudi Arabia”. Again, there is no post by this account that mentions a “Straight Pride Month” being held in the kingdom.

You can also scroll back through the BBC’s Twitter account and check what was posted at the time and hour the tweet that you want to verify was supposedly shared.

And what if the BBC had shared this tweet, only to delete it later? You can also figure that out, because a deleted tweet doesn’t just disappear, it leaves a trace. 

That’s the case, anyway, for this tweet falsely attributed to the BBC about Saudi Crown Prince Mohammed bin Salman. The tweet says there have been “834 quote Tweets”. If you run an advanced search for May 22 on the “@BBCWorld” account, then you should find an indication that the original tweet has been deleted in tweets that mentioned it. But there are none. 

Find a false profile thanks to its photo 

Fake profiles were at the heart of Elon Musk’s abandoned plans to buy Twitter in 2022. Musk said he was worried about the number of Twitter accounts run by robots.  

It’s often possible to identify a fake account by studying one thing in particular – the profile photo. A number of fake accounts on social media try to have a realistic identity. And to do that, they often use photos from the site This Person Does Not Exist.

This is an example of the photos you can find on "This Person Does Not Exist". These photos are often used by fake accounts that want to appear like there is a real person behind it.
This is an example of the photos you can find on "This Person Does Not Exist". These photos are often used by fake accounts that want to appear like there is a real person behind it. © This Person Does Not Exist

The site will generate extremely realistic photos of men, women and children. These photos are often used by fake social media accounts that want to establish a fake identity.

However, it isn’t difficult to identify these false photos. The most basic clue has to do with the position of the eyes. These fake profiles build a face using a grid that always puts the eyes in the same place.  

This grid shows how photos created by the site "Thispersondoesnotexist" always aligns eyes along the same axis.
This grid shows how photos created by the site "Thispersondoesnotexist" always aligns eyes along the same axis. © This Person Does Not Exist

You can hear a detailed description in this video below by Victor Baissait, a tech specialist.

How to check if an account has changed its name?

If you see an account that looks suspicious and you think that it likely changed its handle, then there are ways to find out by looking at its digital footprint – information that is publicly available that will allow you to verify the account’s activity in the past. 

First step: you need to look for interactions that the account had with other accounts in the past, especially replies that they left on other tweets. For that, you should carry out an advanced search on Twitter by clicking the three dots (...) next to the search bar and selecting “Advanced Search.” Then, in the window that says “Account” put the account's name in “To these accounts.”

You can carry out an advanced search on Twitter.
You can carry out an advanced search on Twitter. © Observers

For example, with this search, we were able to see all of the Twitter interactions with the Observers account. 

 

Second step: You need to verify the interactions that the account has had, especially if they have deleted old tweets or if a different name appears in the interaction. 

For example, in the example below, the account @MohammedAbuAq claims to be the brother of Shireen Abu Akleh, a journalist killed in the West Bank by a shot fired by the Israeli army. This account deleted a number of tweets, including the one below. 

This shows the interaction between a Twitter user and MohammedAbuAq on May 9.
This shows the interaction between a Twitter user and MohammedAbuAq on May 9. © Twitter

Third step: use the site Wayback Machine to verify if any of the tweets were archived.  

If you check out the previous tweet using this tool, then you’ll see that it has been archived. You’ll see that, back then, the account wasn’t called @MohammedAbuAq, it was called @K_oiT_.

This is an archived version of the same tweet, which shows that the user @K_oiT_ responded to this user.
This is an archived version of the same tweet, which shows that the user @K_oiT_ responded to this user. © Twitter

 

Fourth step: Check if the Twitter ID is the same. A Twitter account has a unique sequence of numbers that can’t be modified, called a Twitter ID. It’s possible to find these numbers by going onto a site like Tweeter ID. For example, the Twitter ID number associated with the FRANCE 24 Observers account @Observers is 16525194.

However, if you run this number through a search, then you can often find information about an account that has changed its handle a few times but still has the same Twitter ID. 

In our example, that was indeed the case for the account called @MohammedAbuAq and @K_oiT_. In these past, this account was called @Gd_kgo and @Palestineismy and had the same Twitter ID. 

 

The Twitter account @K_oiT_ has exactly the same Twitter ID as the account @MohammedAbuAq, which means that it is the same account that has changed its name.
The Twitter account @K_oiT_ has exactly the same Twitter ID as the account @MohammedAbuAq, which means that it is the same account that has changed its name. © Wayback Machine

 

The Twitter account with the number 1488519840000352264 has also had two other handles in the past @Gd_kgo_ and @Palestineismy.
The Twitter account with the number 1488519840000352264 has also had two other handles in the past @Gd_kgo_ and @Palestineismy. © Yandex

 

If you want to brush up on more techniques to verify online content and avoid fake news, check out our guide