Finding fake accounts: Substack edition
No, Senator Dick Durbin and his twin brother Senator Dick Durbin didn't just subscribe to your Substack newsletter
A few weeks ago, I started noticing short articles from relatively obscure Substack authors racking up substantially more likes and restacks than usual. Although the users doing the liking and restacking are not themselves obvious fakes, many of them have recently picked up swarms of suspicious-looking new accounts as followers or free subscribers. A significant number of these new accounts display signs of inauthenticity, such as the use of plagiarized photographs.
Although Substack does have an undocumented API, it is somewhat limited when it comes to exploring networks of accounts, and the data collection process for this analysis was largely manual as a result. After removing false positives from the collected data, a set of 78 recently-created Substack accounts with the following characteristics was identified:
account has a total of 10 or fewer followers or subscribers
account follows or is a free subscriber to at least 10 times as many accounts as it has followers/subscribers of its own
account is either demonstrably portraying itself as someone else, or has a biography that has been seen frequently on other spam accounts (usually crypto/finance-related)
At least 50 of the 78 accounts use plagiarized photos of non-public figures to represent themselves. While some of these images originated as stock photos, most are pilfered from random people’s social media feeds (usually Instagram), and many of them turn up in databases of images frequently used by romance scammers. Photographs of men with dogs are a recurring theme. In a few instances, the accounts have posted additional stolen photographs of the same individual depicted in their avatars.
Sometimes, the same plagiarized photograph appears as the avatar of more than one fake account. The above image of a man wearing sunglasses and headphones with a dog next to him was used by at least four distinct Substack accounts created between March 11th and March 18th, for example. In this case, the four accounts also have very similar display names, with two calling themselves “James Steve” and the other two going by “James Steven”.
Eleven of the 78 bogus Substack accounts are impersonating prominent U.S. public figures, including four Democratic Senators (Chuck Schumer, John Fetterman, Dick Durbin, and Sheldon Whitehouse), two Democratic members of the House of Representatives (Hakeem Jeffries and Dan Goldman), two generals (Dennis P. LeMaster and Richard D. Clarke), and recently-appointed Health and Human Services secretary Robert F. Kennedy Jr. Both Dick Durbin and Richard D. Clarke have two doppelgängers each, bringing the total number of impersonation accounts in the set to eleven.
Are all 78 of these accounts operated by the same entity? Based on the available information, there is no way to be sure, although certain recurring aspects, such as the reuse of the same names and images, certainly point that direction. It is also possible, of course, that more than one spam network is represented in this set of fake accounts.