How should a moderator handle suspected user impersonation?

Question

On a site where users can choose their own names, sometimes users choose names that are not, or are might not be, their own. If the name is common -- if Amy Adams is using the name Joe Smith, for instance -- it doesn't matter: nobody would have any reason to believe that the account belongs to any particular Joe Smith, of which there are many, and nothing Amy does is going to reflect negatively on any particular Joe Smith.

If the name is rare or effectively unique, though, and that person could conceivably be a user of the site, then we care a lot more. For example, if a user named Jon Skeet shows up on a programming site, or a user named J. Michael Straczynski shows up on a science-fiction site, and that's not really who they are, we don't want those users to use those names because they're misleading.

Then there is the vast space in between these two endpoints. I recently encountered a user who is probably not who he says he is. The name isn't famous and it isn't "Joe Smith" class, but Googling the name leads to a single individual with plausible interest in the topic of my site. There is, therefore, some possibility that what this user posts could be misattributed to an innocent bystander who would (in this case) be unhappy about that misattribution.

On the one hand, we don't want to require users to prove who they are; Google+ skirted that line with their "real names" policy in the early days and there was a lot of backlash. On the other hand, we want to be good Internet citizens, and we care about not harming people. It feels like we need to take this one case by case.

In a situation like this, what are reasonable (and ideally tested) next steps to take?

Answer 1

When I was writing a course on how to use Stack Exchange sites, I got permission to create a second account. I used the same name, Kate Gregory, on that account, and signed in as that to show the low-rep user experience. I asked a very simple C++ question on Stack Overflow to demonstrate how to ask a question.

Within minutes people were commenting "Kate Gregory would never ask that" and similar things. I suspect there were flags on the post as well. I signed into my real account and left a comment explaining what I was doing, and that I had permission. The nice people removed their comments, I removed mine, and I was able to record the rest of the demo.

I tell this story to illustrate that your community will police identity to a certain extent. And the reason they do so is that identity matters. Don't let people pretend to be someone they're not, but don't assume moderators have to do all the work in detecting such people.

Answer 2

Let's call that single individual with plausible interest in the topic of my site the 'original' O, and your site user the 'duplicate' D.

Try to contact O through other channels^*** and tell him you suspect^* someone is using his name as a fake name. Ask him if it is indeed him.

In the follow-up conversation it will quickly become clear if O has a concern about that. If so, he will probably ask you if anything can be done about it.

In that case you contact D and ask him if it really is his name. Quote the relevant parts of O's concerns. Do not accuse D of anything, but point out the possible confusion and that O is not happy with that^**. If D uses a fake name, ask him to change it.

Where this all leads to is hard to predict (too many variations), so I won't speculate on follow-up actions from here.

^{* That would still have to be verified, people with same names do exist
** You don't even care about aliases as long as there are no conflicts
*** It is wise to start the conversation with "You don't know me", and if by any chance the contact method is other than email (e.g. using a webform on a site where O 'is present'), an apology for contacting O in this unusual way}

Answer 3

Given that the real person isn't already a member of your site then you can only really go on the information they provide when they sign up, and compare that to what is publicly available about that person.

You will presumably have user e-mail address which used to help confirm their identity. It's not foolproof - but can help. For example if the e-mail they provide is from a throwaway system like Mailinator then there's a good chance they're not who they say they are. If they say their name is "Eric Smith" but the e-mail address is "[email protected]" then, again, you've got a fairly big clue they're not who they say they are.

Do you know where the real person is likely to be geographically? If you know they live in New York but the IP addresses they use resolve to somewhere else then that's another nail in their coffin.

Make sure your site has rules about impersonation. For example, in section 4 of the Stack Exchange legal stuff there's this:

Under no circumstances will Subscriber use the Network or the Service to ... (c) create a false identity or to impersonate another person

If you suspect that the user is impersonating someone then you can do the following:

1. Do nothing in the short term. Watch the user and make sure that they do nothing that would cause problems for the real person. If they start misbehaving then you can escalate. This would be preferable if the evidence you have is equivocal or flimsy. You might want to contact the user at this point - but can be tricky if there's no hard evidence to back up your assumptions.

2. Reset their username/image to something generic. Back this up with a message explaining why you've done this - you don't want your site to be a source of trouble for that person. Explain that the name/image can be reset if you get assurances they are who they say they are.

3. Reset their name/image and suspend the user account. This will get their attention quickly but really should only be used if you're not 100% certain they're a fake.

4. Delete the account. This may be the simplest solution but carries the highest risk if you're wrong.

One further thing you could consider - if your site's software allows it or can be modified to allow it - is that of introducing a "verified" mark like Twitter or Facebook and other sites have. Offer this as a service to high profile users in your field so that everyone can be sure they are dealing with who they think they are dealing with.

The real user will probably want the verification mark so will be happy to supply the necessary details that will allow you to confirm that they are who they say they are. If they're reluctant to apply even when prompted this could be another indication that they're not who they say they are.

Answer 4

1. I wouldn't do anything if only a Person exist twice without being definitely impersonating him(same Profile Picture, etc...)

Reason: Its not unusual to have the same name like a other Person... If a person is not stalking him or really impersonating him like my example with the Profile Picture he could be another person.

2. If he is using the same name, profile picture, birthday or something else i would confront him directly over the Chat, E-Mail or Teamspeak. I also would talk to the impersonated person if he knows that and if he wants to do anything.

Reason: Why would i ask the impersonated person if i should do anything against it? - Its very simple, if a User was a specified amount of time offline there would be the option that he created a second account. Otherwise i would warn the person who is impersonating, if he/she is not stopping this, that i gonna delete the Account.

3. If the user created a second account, i would ask him if he wants to use the new or the old account. In this case i would delete one account or let him delete one of this

Note: I just would this if the user is not permitted to have a second account(if yes he can use every username he wants, cause its his freedom)