You matched on an app, or met in a Discord server, a game, a comment section. The conversation is good. Before you send money, share your address, get in a car, or fall for them, you want to know one thing: is this person who they say they are?
You can't reach certainty about a stranger on the internet, and anyone who promises you can is selling you something. What you can do is stack independent signals until the picture is consistent enough to act on, or inconsistent enough to walk away. This is the same logic a careful background check uses: no single source proves anything, but four sources that all agree are hard to fake. Below is the checklist, in the order that gets you the most signal for the least effort.
The 5-Step Verification Checklist
Run these top to bottom. The early steps are free and fast and will catch most obvious fakes before you invest anything else.
1. Reverse image search their photos
This is the single highest-value first move. Save their main profile photo and any other clear pictures, then run each one through Google Images, TinEye, and Yandex (Yandex is unusually good at faces). You are looking for three things:
- The same photo appearing under a different name on another profile.
- The photo showing up on a stock-photo site, a model's portfolio, or an influencer's public feed.
- The photo flagged on scam-warning forums like Romancescam.com or Reddit's r/Scams.
A clean result (the photo only appears tied to the name and accounts they gave you) is a green light. A photo that traces back to someone else entirely is the clearest catfish signal there is. For the full breakdown of what a fake profile looks like beyond the photo, read our guide on how to spot a catfish profile.
2. Check their username and public footprint
Most people reuse the same handle across platforms for years. If their dating or chat username is "jordan_makes_things", search that exact string on Instagram, TikTok, X, Reddit, GitHub, YouTube, and Google. A real person with a years-old handle leaves a trail: old posts, comments, a creator account, a professional profile. A fabricated identity usually has either no footprint at all or one that is only days old.
Consistency is what you're checking. Does the age, location, job, and interests in their footprint match what they told you? Small mismatches happen to everyone. A footprint that contradicts their story, or a name with zero presence anywhere despite claiming an active social life, is a reason to slow down.
3. Check email and phone for breach exposure
If they've shared an email or phone number, you can check whether it appears in known data breaches and infostealer logs. This isn't about snooping on their secrets, it's a reality check: a real email that someone has used for years almost always shows up in some historical breach (LinkedIn 2012, Adobe 2013, Collection #1, and so on). An address that is completely absent from every breach database can mean it was created last week purely to talk to you, which fits the disposable-identity pattern scammers use. Start with our free-to-search email breach check, and if you want to know who an address actually belongs to, see who owns this email.
4. Get on a live video call
No amount of OSINT replaces a live, unscripted video call. Ask for one early. The point isn't just to see a face, it's to see a face react in real time to something you ask. Request a spontaneous gesture ("wave with your left hand", "tell me what's on the wall behind you"). Be aware that real-time deepfakes exist in 2026, but they still struggle with sudden movement, hands crossing the face, profile turns, and unexpected questions. Someone who has a constant, escalating set of excuses for why they can never video call is showing you the answer.
5. Meet in a safe, public place first
When you do meet in person: a public place, your own transportation, and one friend who knows where you are and when you'll check in. Share their name and photo with that friend beforehand. This costs nothing and is the final, decisive verification step that the internet can never replace.
Map the public footprint behind a username, email, or phone
PrufAgent searches 250+ public sources and live breach data, then scores the signals honestly. Public Signal Report from $9.99; phone clue preview from $4.99.
Run a scan on /app →Public signals + real breach exposure · no logins, no guarantees
Romance-Scam Red Flags You Should Never Ignore
Romance and "pig-butchering" investment scams cost victims billions a year, and the scripts are remarkably consistent. If you see several of these together, treat the relationship as a scam until proven otherwise:
- They refuse to video call, or the camera "never works", or they only ever send pre-recorded clips and photos.
- The backstory conveniently prevents meeting: offshore oil rig, military deployment, a contract overseas, a doctor with Doctors Without Borders. These are the most-used scammer professions for a reason.
- Love-bombing on a timer. Declarations of love within days, talk of marriage and a shared future before you've met once.
- The conversation steers toward money or crypto. A "can't-miss" investment platform, a customs fee to release a gift, a medical emergency, a stuck inheritance. Any request for gift cards, wire transfers, or crypto is effectively proof.
- They move you off the platform fast, to WhatsApp, Telegram, or text, where there's no moderation and no record.
- Polished but slightly off language, or stories that change details between conversations.
The single most protective rule: never send money, gift cards, or crypto to someone you have not met in person. There is no legitimate version of an online-only partner who needs your financial help. If money has already changed hands, stop immediately, keep all records, and report it to your bank and to your national fraud center (in Canada, the Canadian Anti-Fraud Centre; in the US, the FTC and FBI's IC3).
How PrufAgent Fits Into Verification
Steps 1, 2, and 3 above can each be done by hand, but it's slow and you'll miss things. PrufAgent automates the public-footprint and breach parts of the checklist in one scan. Give it a username, email, or phone number and it searches 250+ public sources with AI web search plus live verification to map the person's public footprint, reused usernames, social, creator, and professional profiles, and combines that with real email breach and infostealer exposure data.
Here's the honest part, because it matters: PrufAgent maps public signals. It does not log into private apps, it does not read anyone's messages, and it does not "confirm" a secret dating account. When it surfaces dating-app presence, that's a confidence-scored public signal, not proof. For a low-footprint person it will tell you plainly that it found no strong matches rather than inventing results. That honesty is the point: a tool that "confirms" everything is a tool that's lying to you. If you want to see exactly where PrufAgent's approach differs from older catfish-finder products, read our comparison, PrufAgent vs Social Catfish.
Use the scan as one of your stacked signals, alongside the reverse image search and the video call, not as a verdict on its own. A clean PrufAgent footprint plus a clean reverse image search plus a real-time video call is a strong, consistent picture. Any one of them turning up a contradiction is your cue to slow down and ask more questions.
Run your first verification scan
Enter a phone, email, or username. See the public profiles, reused handles, and breach exposure tied to it, with honest confidence scoring. Phone clue previews from $4.99; Public Signal Reports from $9.99.
Start a scan on /app →No subscription · results in about a minute
What Verification Can and Can't Tell You
Set your expectations correctly so you don't get a false sense of security. Verification done well can tell you:
- Whether their photos belong to someone else (very high confidence when a match is found).
- Whether their public footprint is consistent with the story they've told you.
- Whether the email or phone they gave you behaves like a real, long-used identity or a fresh disposable one.
- Whether they'll show up live and unscripted on camera.
It cannot tell you whether someone is kind, honest about their intentions, or right for you. It cannot prove a negative ("they are definitely not married", "they definitely have no other accounts"). And it cannot peer inside private apps. Verification reduces the risk of being deceived about identity; it doesn't read minds. Keep using your own judgment, take things at a pace that lets the truth surface, and never let a good scan talk you out of a bad feeling.
Frequently Asked Questions
Can you 100% verify someone you met online?
No. No honest method or tool guarantees certainty about a stranger online. You stack independent signals, a clean reverse image search, a consistent username footprint, a live video call, no scam red flags, until you reach a reasonable confidence level. Verification reduces risk; it doesn't deliver proof.
What's the fastest free first step?
A reverse image search on their profile photos using Google Images, TinEye, or Yandex. If the same face appears under a different name or on a stock-photo site, you have an instant red flag before spending any time or money.
How does PrufAgent help?
It searches 250+ public sources to map the public footprint tied to a username, email, or phone, plus real breach and infostealer exposure, and scores the signals honestly. It does not log into private apps or confirm secret accounts. Public Signal Reports start at $9.99; phone clue previews from $4.99.
What are the biggest romance-scam red flags?
Refusing to video call, a backstory that always explains why they can't meet, love-bombing within days, and any request for money, gift cards, or crypto. Never send funds to someone you haven't met in person.