What a ghost account is
A ghost account is a social-media profile that exists only to make a scam look legitimate. The scammer creates an account on X, Instagram, LinkedIn, Telegram, or Discord, fills out the basics (name, photo, bio), maybe posts a few generic items, then uses the account to either pitch the scam directly or to amplify someone else's pitch.
Ghost accounts are the most disposable infrastructure in the scam ecosystem. A single scam syndicate can run hundreds at once.
The five tells
- Account is new. Created in the last 30-60 days. Most platforms display join date publicly.
- Few posts, low engagement. 3-10 generic posts ('good morning', 'great investment opportunity'), all with single-digit likes that often come from other ghost accounts.
- Profile photo is stolen or AI-generated. Reverse-image search the photo. AI-generated faces often have asymmetric earrings, weird teeth, or a hairline that doesn't quite match the head shape.
- Bio is generic or industry-specific in a hollow way. 'Crypto trader | Investor | DM for opportunities' with no specific projects, no track record links, no actual content.
- Followers are also ghosts. Click through the followers list. If 90% of them are accounts with no profile photo, no posts, and 'JoinedRecently', the network is fake.
Where ghost accounts get used
- Investment pitches. 'I made $50k on this token, DM me how.' The DM leads to a fake exchange.
- Romance scam openings. The cover-story account (oil rig worker, military officer, doctor abroad) is a ghost.
- Customer-support impersonation. A ghost account with 'CommBank Support' in the bio replies to anyone tweeting at the real CommBank, then DMs them a phishing link.
- Job-mule recruitment. 'HR Manager at
' DMs a target with a job offer that turns into a money-mule task.
What to do
Before engaging with any account that's pitching you anything, check the basics: how old is it, how many posts, who follows it, are the photos reverse-searchable. If the answer is 'new, few, ghosts, stolen', walk away.
For social handles you receive in DMs or messages: paste the handle into AVA for an independent risk score with explainable reasoning. See the public how-it-works summary for our methodology overview.