A catfish check is what you do before you let a dating profile matter. Someone you have not met is charming, quick to move the conversation off the app, and a little vague about where they are. You are not accusing them of anything by checking; you are doing what you would do before any decision with a stranger. This guide is the version I give friends: a reverse image search, a username search, join dates and bio link chains, a table of mismatch signals, and what to do with the answer.
Two rules first. Everything here reads public data and contacts nobody. And the goal is to check a profile, not to investigate a person, so the moment a check answers your question, stop.
Start with the picture
Photos are the cheapest thing to steal and the easiest to check. Save the main profile photo and run it through a reverse image search. The FTC's romance scam guidance says the same thing in plain words: do a reverse image search of the person's profile picture, and if the details do not match, it is a scam. You are looking for the same face on a stock site, a portfolio, a news story, or a social account under a different name. A picture that appears nowhere else is neutral; most real people's photos do not index either. A picture that appears under another name is the strongest single signal in this guide.
Check more than one photo. Persona profiles are often assembled from a single stolen set, and the second and third photos land on the source when the headshot does not.
Catfish check with a username search
Most dating apps show a first name, but people reuse handles, and a handle usually surfaces somewhere: an Instagram in the bio, a Snapchat they offer within a day, a gamer tag, a Venmo. Once you have one handle, run it as a username search on osintsearch.org. The engine checks it against 770 username endpoints, pulls the public profile behind each hit with its display name, picture, bio, join date and outbound links, and stacks the pictures and names at the top so you can see whether they describe one person.
Read the result as a whole rather than hit by hit. A handle that resolves across eight platforms to the same name, the same face and a plausible join history is consistent with a real person. A handle that resolves to a different name and face on every platform belongs to someone else, and the dating profile borrowed it. A handle that exists only on the account they gave you, created recently, is thin. Thin is not fake, but thin plus a stolen photo is.
The username search tool guide covers how to weigh a hit before treating it as the same person, and the old usernames guide covers the rename trail, which matters here because a persona account is often a renamed real one.
Join dates and bio link chains
Platforms assign two things the owner cannot type: an id and a date. Instagram publishes a join month in its about-this-account panel and the engine returns it as created_at. Twitter, Reddit, GitHub and many others publish join dates too. A profile that claims a settled life, a career abroad or a long-widowed past and joined everything six weeks ago is telling you two different stories. Instagram also lists former usernames on that panel, and a rename from an unrelated handle to the persona's name is the fingerprint of a bought account. The nine Instagram checks go deeper on ids, dates and rename history.
Bio links are the other trail. Real profiles link to each other: the Instagram bio names the YouTube channel, the YouTube about page links the website, the website links back. Persona profiles link to nothing that can be checked, or link to handles whose name does not match. Follow each link until it lands on a profile with its own picture and date, and note where the chain breaks. Pro plans run that chain automatically as a deep search, re-sweeping every handle found in a bio across the full platform list.
Mismatch signals, with weights
| Signal | Where you see it | Weight |
|---|---|---|
| Profile photo found under another name | Reverse image search | Strong |
| Handle resolves to a different name and face elsewhere | Username search | Strong |
| Instagram former username unrelated to the persona | About-this-account, former_usernames | Strong |
| All accounts joined within the last few months | Join dates across hits | Medium |
| Bio links go nowhere checkable | Link chain | Medium |
| Large following, almost no posts | Follower count vs post count | Medium |
| Claims work abroad, military posting or oil rig; cannot video call | Conversation | Medium |
| Asks to move off the app immediately | Conversation | Low alone, high with any strong signal |
| Mentions money, crypto, gift cards or a customs fee | Conversation | Decisive |
| Photo appears nowhere else | Reverse image search | Neutral |
The conversation signals come from the FTC's own list: a scammer says they cannot meet in person because of work abroad or the military, asks for money by wire, gift card, payment app or cryptocurrency, and pushes to act fast. The public-data signals are how you catch it before the money question arrives.
A worked pass, in the order I run it
1. Save the profile photos -> reverse image search each one
2. Collect every handle offered -> username search each one
3. Read the identity block -> one name, one face, or several?
4. Note join dates -> oldest account vs the story told
5. Follow bio links -> does the chain close or break?
6. Score the table above -> any Strong or Decisive row?
7. Decide -> continue, ask one question, or stopStep three is where a hosted search earns its place over a checker that only lists URLs. The identity block on an OSINTsearch result stacks the display names, pictures, locations and outbound links from every hit and tells you how many hits agree. On a real public figure's handle we exported this week, 59 hits agreed on one name and the block kept 8 pictures of the same person. That is what consistent looks like. A block that holds three names and two faces is what borrowed looks like.
Step seven has a middle option most guides skip. If the checks are mixed, ask for one thing a persona cannot give: a short video call, or a photo holding something you name. A real person will find it odd and do it. A persona will have a reason not to.
What to do next
If the checks come back clean, you have done your part. Keep the ordinary rules (meet in public, tell a friend, keep money out of it) and let the rest be a relationship. Nobody needs to know you checked.
If one strong signal fires, stop replying. You do not owe an explanation, and a persona operator treats any reply as a lead. Report the profile inside the app so the platform can act on the account and on the other profiles using the same photos. Screenshot the profile and the conversation before it disappears, and export your search results with their timestamp; the profile will be gone within days once reported, and the export is the record that it looked the way it did.
If money moved, act in this order: bank or payment provider, then the platform, then the fraud reporting service. Banks can sometimes recall a recent transfer; a report to ReportFraud.ftc.gov helps the pattern get tracked even when your own money is gone. And tell someone; romance scams work by isolating people.
A free account runs 15 searches a week with every field on every hit, which is enough to see whether a handle resolves anywhere, how old the accounts are and whether the pictures match. Starter, at $20 a month for 50 a week, adds CSV and JSON export and breach names and dates. Pro, at $49.99 for 500 a week, adds deep search on bio handles and the full breach records for a linked email. The pricing page has the matrix.
FAQ
Is it legal to run a catfish check on someone I met on a dating app?
Reading public profiles and running a reverse image search on a photo you were sent is looking at public information, which is what the FTC itself recommends. What changes the picture is what you do with the result: contacting, exposing or harassing anyone is a different act with its own consequences, and this guide stops before it.
What if the reverse image search finds nothing?
That is the normal result for most real people, and it is neutral rather than reassuring. Move on to the username search and join dates. A persona built from private photos of a real person will pass the image check and fail the handle and date checks.
Can a username search tell me who a catfish really is?
No, and it should not be used to try. It tells you whether the handle resolves to a consistent public identity and whether the dating profile matches it. Attribution of the person operating a persona is a matter for the platform and, where money is involved, for law enforcement.
Which checks work on the free plan?
Every check on the cards works on Free: where the handle exists, the join dates, the banned state, and the pictures and names side by side. Exporting the record needs Starter; following bio link chains automatically and reading full breach records need Pro.
Check once, then decide
The point of a catfish check is to spend twenty minutes so you do not spend twenty weeks. Run the photo, run the handle, read the dates, follow the links, and trust the pattern over the story. Most profiles will pass, and you can put the checklist away. The ones that do not are the reason it exists.
