You almost never have nothing. Someone you met online has handed you at least one of three things: a photo, a phone number, or an email address. Most people check one of them, find nothing alarming, and stop.
That is the mistake. Each of the three answers a different question, and a fake profile usually survives one check while failing another. A stolen photo can sit behind a perfectly ordinary mobile number. A real person’s phone can be attached to an email address created last Tuesday. Checking all three takes about ten minutes and the three answers together tell you far more than any one of them alone.
Here is the order to do it in, and what each step can and cannot prove.
Step 1: The photo — does this face exist anywhere else?
Start here, because it is the fastest and the most likely to settle the question outright. A catfish profile is built from images that already exist somewhere: a model’s portfolio, a stranger’s Instagram, a stock library. Find where else that face appears and you either confirm a consistent identity across years and accounts, or you find the real owner and you are done.
Use face recognition rather than ordinary reverse image search. Google Lens and TinEye look for copies of the same file — same crop, same compression. Crop the picture or run a filter over it and the match vanishes. Face recognition maps the geometry of the face, so it finds the same person in a different photo entirely.
Three outcomes worth knowing how to read:
- Matches on accounts with different names. The strongest signal you will get. The same face running as “Daniel” on one platform and “Marcus” on another is not a coincidence.
- No matches at all. Ambiguous, not clean. It can mean a private person with a small footprint — or a photo taken from somewhere that was never indexed.
- Matches that all trace to one consistent identity. The best realistic result. One name, one history, photos spanning years.
If you have two photos and want to know whether they show the same person, face comparison answers that directly. For the full method, see catfish reverse image search.
Step 2: The phone number — is this a line someone actually lives with?
A photo tells you who the pictures belong to. The phone number tells you something the photo cannot: how much the person has invested in being reachable.
This matters because of how disposable numbers work. A real mobile line is tied to a contract, a SIM, a carrier, and usually years of use. A VoIP or virtual number costs nothing, is issued in seconds, and is discarded the moment it becomes inconvenient. Scammers use the second kind almost exclusively, because the whole operation depends on being able to vanish.
So the useful questions are not “who owns this number” — that is rarely public — but:
- Is it a real mobile line or a VoIP number? A virtual number on a profile that claims a settled local life is a contradiction.
- Does the carrier and region match their story? Someone who says they live two towns over, on a number issued in another country, is worth a second look.
- Has the number been reported before? Numbers used in scams tend to accumulate complaints quickly.
We built CatchNumber for exactly this check — it is our own tool, and it reports line type, carrier and region for a number. Any reverse phone lookup that distinguishes VoIP from a real mobile line will do.
One caution: a clean phone number proves very little on its own. Plenty of honest people use VoIP, and plenty of scammers buy real SIMs. It is a weight on the scale, not a verdict.
Step 3: The email address — how old is this identity?
The email address is the one people skip, and it is often the most revealing of the three, because an email address accumulates history whether its owner wants it to or not.
A real person’s address is years old. It has been used to sign up for things. It appears in old data breaches — which sounds bad but is actually reassuring, because it means the address existed back then and was used normally. It is attached to profiles the person has half-forgotten.
A fabricated identity has an address created days or weeks ago, with no history anywhere. That absence is the signal.
- How old is the address, and is the domain disposable? A throwaway domain behind a serious conversation is a mismatch.
- Which accounts are registered to it? Linked profiles give you more names and photos to run back through Step 1.
- Does it appear in historical breach data? Counterintuitively, appearing is the good outcome. It proves age.
We use RevealEmail for this, also ours. Whatever you use, you are looking for age and history, not a name.
Reading the three answers together
This is the part that makes the exercise worth doing. The combinations matter more than the individual results.
| What you found | What it most likely means |
|---|---|
| Photo matches a different name, anywhere | Stop. This is the clearest result there is. |
| No photo matches, VoIP number, brand-new email | Three absences pointing the same way. Treat as fabricated. |
| No photo matches, real mobile line, years-old email | Most likely a genuinely private person. |
| Photo traces to one consistent identity, everything else matches | As verified as remote checking gets. |
| Photo and email check out, number is VoIP | Weak signal on its own. Many people use VoIP. |
| Everything clean, but they refuse a video call | Behaviour beats data. Trust the refusal. |
The pattern to internalise: one bad signal is a question, two pointing the same way is an answer. Fabricated identities are cheap to make but expensive to age, so they tend to fail on history — no photo footprint, no email history, a number issued last month. Real people leave messy, inconsistent, years-deep trails.
What none of this proves
Being straight about the limits, because overconfidence here is its own risk.
None of these checks confirm identity. They surface leads you then verify yourself. A face match is a link to a page you should open and read, not a legal conclusion — faces genuinely resemble each other, and a 70% similarity score is a maybe, not a yes. None of this is admissible as proof of anything, and none of it may be used for decisions about employment, credit, housing or insurance.
And the cheapest check still outperforms all three: ask for a live video call. Someone using stolen photos cannot pass one. If the person you are verifying has an endless supply of reasons why a call is impossible, you already have your answer and no amount of searching will give you a better one.
Where these tools earn their place is the stage before that — when you want to know whether a video call is even worth arranging, or when someone has already passed one and you want to confirm the rest of the story holds up.
