Catfishing
Also known as: romance scam, fake online identity, pig butchering scam, online identity fraud, fake profile
Catfishing is the practice of creating a fake online identity (using fabricated photos, false personal details, and a constructed persona) to deceive another person, typically for romantic manipulation, financial fraud (romance scams), or emotional harm.
The term was popularized by the 2010 documentary 'Catfish' and the subsequent MTV series of the same name. Catfishing can range from someone using slightly altered photos on dating apps to sophisticated fraud operations that maintain fake identities for months to extort money from victims. The practice disproportionately affects online dating contexts but occurs across social media platforms and gaming communities.
Catfishing, explained at three levels
At home
Catfishing is when someone creates a fake online profile (using someone else's photos or completely made-up information) to pretend to be a different person. They might use stolen photos of an attractive person, invent a compelling life story, and build a relationship (romantic or otherwise) while hiding their real identity. People catfish for different reasons: some are insecure about their own identity and are living a fantasy, others are deliberately trying to extract money or embarrassing information from the victim, and some want to cause emotional harm.
At work
Catfishing is professionally relevant as a security and fraud risk: employees may be catfished by people seeking to extract sensitive company information through a manufactured personal relationship (a form of social engineering). Job candidates have been catfished by fake employer profiles conducting 'interviews' to extract personal information or upfront fees. Fake recruiter profiles on LinkedIn (using real people's photos) are a documented fraud vector. Training employees to verify the identity of new online contacts before sharing sensitive personal or professional information is a basic security hygiene measure.
At home
A catfish identity has three working parts. The persona is built from stolen photos, usually lifted from a real person's Instagram or a model's portfolio, plus a backstory that explains why meeting is impossible, such as working abroad or a military deployment. The relationship is then accelerated with constant messaging and early declarations of affection, sometimes called love bombing. Finally comes the ask: money, gift cards or private images. Reverse image search tools such as Google Lens and TinEye can expose stolen photos by matching them against copies elsewhere online.
At work
Romance scam mechanics relevant to business security: scammers often target employees with access to financial systems or sensitive data through catfishing on LinkedIn, professional networks, or even email. The 'pig butchering' scam (an evolution of romance scams that adds cryptocurrency investment fraud) establishes trust over weeks or months before introducing an 'investment opportunity'. Business email compromise (BEC) attacks often begin with social engineering to gather intelligence about internal processes. Understanding the stages of relationship-building before fraud (trust establishment, emotional dependency, the 'ask') helps employees recognize manipulation before they become victims.
At home
The industrial scale of romance fraud: FTC data consistently ranks romance scams among the costliest fraud categories for US consumers, with older adults (55+) most financially vulnerable due to larger savings and higher trust in emotional relationships. The Internet Crime Complaint Center (IC3) reports billions in annual romance scam losses. Large-scale romance fraud operations (particularly 'pig butchering' scams originating in Southeast Asia, sometimes operated using trafficked labour) use teams of people to manage hundreds of simultaneous fake relationships, using scripts, shared photos, and coordinated personas: essentially customer relationship management systems applied to fraud.
At work
Platform-level catfishing countermeasures: dating apps have implemented photo verification (Tinder's and Bumble's photo verification, Hinge's selfie verification badges) requiring users to take a selfie matching a pose, which is compared to profile photos. LinkedIn has implemented AI-generated profile photo detection and identity verification features. These measures reduce but do not eliminate catfishing because: verification is point-in-time (verified once, not continuously), sophisticated operations acquire real identity documents, and the platforms that see the most catfishing (SMS, WhatsApp, email) have no identity verification infrastructure. The detection challenge grows with AI-generated faces and voice cloning.
Real-world examples
At home
Lena matched with someone on a dating app who had professional-quality photos and claimed to be an engineer working abroad. After three weeks of daily messages, he asked her for help with an 'emergency' after being robbed while travelling and needing money to get home. She did a reverse image search of his profile photos and found them on a Brazilian model's public Instagram account. She reported the profile and blocked the account: this was a textbook catfishing romance scam attempt.
At work
Carlos worked in finance at a mid-size company. He received a LinkedIn connection request from someone claiming to be a recruiter at a prestigious firm. Over several messages, the recruiter asked detailed questions about his company's approval processes and financial system access before mentioning a role. The questions were unusually specific about internal controls. He verified the recruiter's identity by calling the firm directly and discovered no such person worked there: the account was using a real employee's photo stolen from the firm's website. He reported the account to LinkedIn and flagged the social engineering attempt to his company's security team.
Common confusions
- Many people assume catfishing is primarily a problem for naive or inexperienced internet users — Romance scam victims include educated, professionally successful, and internet-savvy individuals. The psychological mechanisms that catfishers exploit (emotional vulnerability, loneliness, the universally human desire for connection and validation) are not correlated with internet sophistication. FTC data shows losses are highest among 40-70 year old demographics, which includes highly educated professionals. Being skeptical and internet-literate helps with technical detection (reverse image search) but does not eliminate vulnerability to emotional manipulation over extended time periods.
- Some assume catfishing is primarily about romantic fraud and does not overlap with professional security concerns — Catfishing is a social engineering technique that appears across contexts: corporate espionage (building fake professional relationships to extract company information), recruitment fraud (fake job offers to extract personal information or application fees), and vendor fraud (impersonating suppliers to redirect payments). The 'pig butchering' scam combines romantic catfishing with cryptocurrency investment fraud targeting people with significant savings. Security awareness training increasingly includes catfishing/social engineering recognition as a component of employee cybersecurity education.
For analysts
Catfishing is relevant in two client contexts: security training (helping organizations train employees to verify online identities before sharing sensitive information or engaging in personal relationships that could create leverage) and digital trust (for platforms with user communities, identity verification reduces catfishing risk and improves platform trust). For consumer-facing digital platforms, the practical recommendation is multi-factor identity verification beyond email, particularly for platforms where romantic or financial relationships are common (dating apps, peer-to-peer marketplaces, investment platforms). For enterprise clients, social engineering awareness training that includes catfishing scenarios is part of a complete security awareness program.
History & origin
The term 'catfish' in this context was popularized by the 2010 documentary film 'Catfish' (Schulman et al.), which followed a man who discovered his online romantic relationship was being conducted by a woman using fabricated photos and identity. The subsequent MTV series 'Catfish: The TV Show' (launched 2012) helped the term enter mainstream language. The practice itself predates the term by decades: online identity deception began with early chat rooms and bulletin boards in the 1990s. Romance scam operations (often originating in West Africa, Eastern Europe, and Southeast Asia) have professionalized catfishing for financial fraud at scale, costing US victims over $1 billion per year according to FTC data. Military romance scams (impersonating deployed military personnel to exploit emotional vulnerability) are documented as a specific catfishing sub-type. Social media platform improvements in photo verification and identity checks have had limited impact because photo theft from real people's social accounts makes detection difficult.