How to Verify Someone You Met Online (2026)

You matched on an app, or met in a Discord server, a game, a comment section. The conversation is good. Before you send money, share your address, get in a car, or fall for them, you want to know one thing: is this person who they say they are?

You can't reach certainty about a stranger on the internet, and anyone who promises you can is selling you something. What you can do is stack independent signals until the picture is consistent enough to act on, or inconsistent enough to walk away. This is the same logic a careful background check uses: no single source proves anything, but four sources that all agree are hard to fake. Below is the checklist, in the order that gets you the most signal for the least effort.

The 5-Step Verification Checklist

Run these top to bottom. The early steps are free and fast and will catch most obvious fakes before you invest anything else.

1. Reverse image search their photos

This is the single highest-value first move. Save their main profile photo and any other clear pictures, then run each one through Google Images, TinEye, and Yandex (Yandex is unusually good at faces). You are looking for three things:

• The same photo appearing under a different name on another profile.
• The photo showing up on a stock-photo site, a model's portfolio, or an influencer's public feed.
• The photo flagged on scam-warning forums like Romancescam.com or Reddit's r/Scams.

If no conflicting image appears, treat that as one limited positive signal, not proof. Search tools can miss private, deleted, new, or unindexed images. A photo that clearly traces to a different person is a serious catfish signal. For the full breakdown of what a fake profile looks like beyond the photo, read our guide on how to spot a catfish profile.

2. Check their username and public footprint

Most people reuse the same handle across platforms for years. If their dating or chat username is "jordan_makes_things", search that exact string on Instagram, TikTok, X, Reddit, GitHub, YouTube, and Google. A real person with a years-old handle leaves a trail: old posts, comments, a creator account, a professional profile. A fabricated identity usually has either no footprint at all or one that is only days old.

Consistency is what you're checking. Does the age, location, job, and interests in their footprint match what they told you? Small mismatches happen to everyone. A footprint that contradicts their story, or a name with zero presence anywhere despite claiming an active social life, is a reason to slow down.

3. Check email exposure and verify phone clues separately

For an email shared with permission, use Have I Been Pwned for historical breach notices and the masked PrufAgent exposure check for aggregate Hudson Rock infostealer status. A no-match result does not prove an address is new, safe, or disposable. Phone clues should be verified separately through official published contact channels and browser-visible public sources; PrufAgent does not query a historical phone-breach catalog. If Facebook is the specific clue you need to check, start with the source-linked Facebook phone search.

4. Get on a live video call

No amount of OSINT replaces a live, unscripted video call. Ask for one early. The point isn't just to see a face, it's to see a face react in real time to something you ask. Request a spontaneous gesture ("wave with your left hand", "tell me what's on the wall behind you"). Be aware that real-time deepfakes exist in 2026, but they still struggle with sudden movement, hands crossing the face, profile turns, and unexpected questions. Someone who has a constant, escalating set of excuses for why they can never video call is showing you the answer.

5. Meet in a safe, public place first

When you do meet in person: a public place, your own transportation, and one friend who knows where you are and when you'll check in. Share their name and photo with that friend beforehand. This costs nothing and is the final, decisive verification step that the internet can never replace.

Romance-Scam Red Flags You Should Never Ignore

Romance and "pig-butchering" investment scams cost victims billions a year, and the scripts are remarkably consistent. If you see several of these together, treat the relationship as a scam until proven otherwise:

• They refuse to video call, or the camera "never works", or they only ever send pre-recorded clips and photos.
• The backstory conveniently prevents meeting: offshore oil rig, military deployment, a contract overseas, a doctor with Doctors Without Borders. These are the most-used scammer professions for a reason.
• Love-bombing on a timer. Declarations of love within days, talk of marriage and a shared future before you've met once.
• The conversation steers toward money or crypto. A "can't-miss" investment platform, a customs fee to release a gift, a medical emergency, or a stuck inheritance. Any request for gift cards, wire transfers, or crypto is a critical stop sign.
• They move you off the platform fast, to WhatsApp, Telegram, or text, where there's no moderation and no record.
• Polished but slightly off language, or stories that change details between conversations.

The single most protective rule is to never send money, gift cards, or crypto to someone you have not met in person. The FTC gives the same guidance. If money has already changed hands, stop immediately, preserve messages and receipts, contact the payment provider, and report it. In Canada, use the Canadian Anti-Fraud Centre reporting service. In the United States, report to the FTC and the FBI's IC3.

How PrufAgent Fits Into Verification

Steps 1, 2, and 3 above can each be done by hand, but it's slow and you'll miss things. PrufAgent automates the public-footprint and supported aggregate exposure parts of the checklist in one scan. Give it a username, email, or phone number and it searches public web sources with AI web search plus live verification to map the person's public footprint, reused usernames, social, creator, and professional profiles, and combines that with aggregate Hudson Rock infostealer status for supported email or username reports.

Here's the honest part, because it matters: PrufAgent maps public signals. It does not log into private apps, it does not read anyone's messages, and it does not "confirm" a secret dating account. When it surfaces dating-app presence, that's a confidence-scored public signal, not proof. For a low-footprint person it will tell you plainly that it found no strong matches rather than inventing results. That honesty is the point: a tool that "confirms" everything is a tool that's lying to you. If you want to see exactly where PrufAgent's approach differs from older catfish-finder products, read our comparison, PrufAgent vs Social Catfish.

Use the scan as one of your stacked signals, alongside reverse image search and a live video call, not as a verdict. A consistent public footprint can reduce one category of concern, but it cannot establish identity, intent, or safety. Any contradiction is a reason to slow down and verify through an independent channel.

What Verification Can and Can't Tell You

Set your expectations correctly so you don't get a false sense of security. Verification done well can tell you:

• Whether their photos belong to someone else (very high confidence when a match is found).
• Whether their public footprint is consistent with the story they've told you.
• Whether public pages support the username, email, or phone context they gave you.
• Whether they'll show up live and unscripted on camera.

It cannot tell you whether someone is kind, honest about their intentions, or right for you. It cannot prove a negative ("they are definitely not married", "they definitely have no other accounts"). And it cannot peer inside private apps. Verification reduces the risk of being deceived about identity; it doesn't read minds. Keep using your own judgment, take things at a pace that lets the truth surface, and never let a good scan talk you out of a bad feeling.

Frequently Asked Questions

Can you 100% verify someone you met online?

No. No honest method or tool guarantees certainty about a stranger online. Stack independent signals such as reverse image results, a consistent public username footprint, a live video call, and no scam red flags. Verification reduces risk; it does not prove identity, intent, or safety.

What is the fastest first step to check someone?

A reverse image search on their profile photos using Google Images, TinEye, or Yandex. If the same face appears under a different name or on a stock-photo site, you have an instant red flag before spending any time or money.

How does PrufAgent help verify an online match?

PrufAgent searches public web sources tied to a username, email, or phone. It can return source-backed public profile references, confidence labels, and aggregate Hudson Rock infostealer status for supported email or username reports. It does not log into private apps or confirm secret accounts.

What are the biggest romance-scam red flags?

Refusing to video call, a backstory that always explains why they can't meet, love-bombing within days, and any request for money, gift cards, or crypto. Never send funds to someone you haven't met in person.

What can I check with a username, email, or phone number?

A username or email can lead to browser-visible profile and web references. A supported email or username report may also include aggregate Hudson Rock infostealer status. A phone preview parses number structure, while a paid phone report checks exact-number public references. Results can be sparse when public evidence is unavailable.

Does no online footprint mean the person is fake?

No. A person may use private accounts, different identifiers, or very little social media. A zero-result report is not proof that an identity is real or fake; it means the checked public sources did not support a stronger conclusion.

What should I do if I already sent money?

Contact the bank, card issuer, payment app, gift-card company, or cryptocurrency platform immediately and ask whether the transfer can be stopped or recovered. Preserve messages and receipts, stop contact, notify the platform where you met, and report the fraud to the appropriate national authority.