How to investigate a Twitter account or suspicious tweets

What to do when you are looking at an unfamiliar Twitter account 

When you see a suspicious post on Twitter from an unfamiliar author, here’s where you should start:

• First, check to see if the account is certified. In that case, the person will have a blue badge next to their name (but, remember, this alone isn’t enough to earn your trust because this, too, can be doctored). 
• Check the account’s name to see if there are misleading upper or lower case letters (for example, a capital "i" looks very similar to a lowercase "l")
• Read the account bio. Sometimes the bio will explain that the account is a parody and not the real thing
• Examine the profile picture (we have info below on how to spot a fake profile picture) 

If you are wary of an account, you can also analyse its activity using free tools such as Foller.me or Botometer.

These two tools can give you information on an account’s activity and can even let you know if an account seems to be fake or run by a robot. 

In February 2022, several Twitter accounts made to look like they were affiliated with the American channel CNN shared false information.  

These accounts used the American news channel’s logo and had handles that looked like they could be official: @CNNUKR and @CNNAfghan. They were used to spread an unfounded rumour about the death of an American journalist in Ukraine. 

However, these two accounts don’t have the Twitter certification, unlike official CNN accounts like @CNN or the regionally specific @cnnphilippines. CNN has, by the way, reported these two fake accounts, which have since been suspended (check out this article by our fact-checking colleagues at French news agency AFP here). 

It’s important to get into the habit of verifying a Twitter account that looks like a media account but doesn’t have the Twitter certification badge. Watch out because some accounts use the “✔️” or "✅" emoji to make it look like they are certified. However, the true Twitter certification looks like a little medallion next to a user name. It’s either blue or white depending on your version of Twitter (light or dark background). 

If an account doesn’t have this certification, then you need to be careful. However, not having the certification doesn’t necessarily mean that an account is fake – for example, it could be a media with a small audience or a new media outlet that hasn’t finished the certification process.

Digitally altering a tweet

Most “fake tweets” circulating online are screengrabs that have been digitally altered.

There are a few methods, available to all, to create fake tweets, which are sometimes very realistic. 

Some tweets are modified using software like Photoshop. You can sometimes identify these tweets if you inspect the font and the number of characters used because, very often, they are different from the Twitter standards.

Here’s an example of a fake tweet made to look like it was shared by the BBC. The tweet is about Emmanuel Macron, whom it claims announced that “60 million refugees” will be coming to Europe.  

If you look a bit closer, then you’ll see that the text is outlined with a colour that is slightly different to the background. Moreover, the number of characters used surpasses the 280 authorised by Twitter.

We scrolled through the BBC’s Twitter feed and found a tweet from the British channel that has a similar image and was shared at the same time. However, the content has nothing to do with refugees, as you can see below. 

The BBC also denied that it put out this tweet. 

Another example is this tweet falsely attributed to CNN about a secret Chinese document that predicts that multiculturalism will cause the downfall of the west. 

This tweet does, of course, have a certification and CNN’s real handle. However, you can see that the text has a light outline in grey and the number of characters used, 302, surpasses Twitter’s 280 character limit.  

Modified source codes

Doctoring an image using Photoshop or another tool isn’t the only simple way that someone can modify a tweet. 

You can also change the text of a tweet by modifying the page’s source code. If you do this, then you can change the contents of a tweet on your screen, but you can’t save these modifications. 

However, once someone has modified the text of a tweet, then they can take a screengrab of the image, which they can then share on social media. The modified tweet looks very real. 

Below, we’ve demonstrated how you can modify the source code of a publication on our Twitter account (@Observers).

Moreover, there are actually sites online where you can generate fake tweets. You just type in a user name, upload a profile picture and choose a time. You can even add a verification badge if you like. You can’t share these directly on Twitter but, again, you could post a screengrab of the image. 

How to verify

There are a few ways that you can detect these fake tweets. First of all, you can check if the suspicious tweet actually did appear on the Twitter feed of the account that supposedly published it or not. 

Let’s take this example of the tweet falsely attributed to the BBC that was circulating on Twitter in late May.

You can see the verification badge on this screengrab. The username matches with an official BBC Twitter page, “@BBCWorld”. To check if the outlet has indeed posted this tweet, we can run the keywords that appear in the tweet through an advanced search on Twitter.  

For example, you can type this into the Twitter search bar: [“Saudi” AND “Pride” (from:BBCWorld)]. The “AND” indicates that we want to look for tweets featuring both of these two keywords. The (from:BBCWorld) establishes that we only want to search for tweets shared by this particular BBC Twitter account. 

It turns out that no tweets using these two words come up in this search. You can use the same method to see any tweets shared by that BBC account featuring the words “Saudi Arabia”. Again, there is no post by this account that mentions a “Straight Pride Month” being held in the kingdom.

You can also scroll back through the BBC’s Twitter account and check what was posted at the time and hour the tweet that you want to verify was supposedly shared.

And what if the BBC had shared this tweet, only to delete it later? You can also figure that out, because a deleted tweet doesn’t just disappear, it leaves a trace. 

That’s the case, anyway, for this tweet falsely attributed to the BBC about Saudi Crown Prince Mohammed bin Salman. The tweet says there have been “834 quote Tweets”. If you run an advanced search for May 22 on the “@BBCWorld” account, then you should find an indication that the original tweet has been deleted in tweets that mentioned it. But there are none. 

Find a false profile thanks to its photo 

Fake profiles were at the heart of Elon Musk’s abandoned plans to buy Twitter in 2022. Musk said he was worried about the number of Twitter accounts run by robots.  

It’s often possible to identify a fake account by studying one thing in particular – the profile photo. A number of fake accounts on social media try to have a realistic identity. And to do that, they often use photos from the site This Person Does Not Exist.

The site will generate extremely realistic photos of men, women and children. These photos are often used by fake social media accounts that want to establish a fake identity.

However, it isn’t difficult to identify these false photos. The most basic clue has to do with the position of the eyes. These fake profiles build a face using a grid that always puts the eyes in the same place.  

You can hear a detailed description in this video below by Victor Baissait, a tech specialist.

How to check if an account has changed its name?

If you see an account that looks suspicious and you think that it likely changed its handle, then there are ways to find out by looking at its digital footprint – information that is publicly available that will allow you to verify the account’s activity in the past. 

First step: you need to look for interactions that the account had with other accounts in the past, especially replies that they left on other tweets. For that, you should carry out an advanced search on Twitter by clicking the three dots (...) next to the search bar and selecting “Advanced Search.” Then, in the window that says “Account” put the account's name in “To these accounts.”

For example, with this search, we were able to see all of the Twitter interactions with the Observers account. 

Second step: You need to verify the interactions that the account has had, especially if they have deleted old tweets or if a different name appears in the interaction. 

For example, in the example below, the account @MohammedAbuAq claims to be the brother of Shireen Abu Akleh, a journalist killed in the West Bank by a shot fired by the Israeli army. This account deleted a number of tweets, including the one below. 

Third step: use the site Wayback Machine to verify if any of the tweets were archived.  

If you check out the previous tweet using this tool, then you’ll see that it has been archived. You’ll see that, back then, the account wasn’t called @MohammedAbuAq, it was called @K_oiT_.

Fourth step: Check if the Twitter ID is the same. A Twitter account has a unique sequence of numbers that can’t be modified, called a Twitter ID. It’s possible to find these numbers by going onto a site like Tweeter ID. For example, the Twitter ID number associated with the FRANCE 24 Observers account @Observers is 16525194.

However, if you run this number through a search, then you can often find information about an account that has changed its handle a few times but still has the same Twitter ID. 

In our example, that was indeed the case for the account called @MohammedAbuAq and @K_oiT_. In these past, this account was called @Gd_kgo and @Palestineismy and had the same Twitter ID. 

If you want to brush up on more techniques to verify online content and avoid fake news, check out our guide.