The catfishing meaning most people know comes from dating apps: someone builds a fake online identity to lure another person into a relationship that exists only on a screen. The same trick works on businesses. Fake profiles, invented job histories, and borrowed photos give attackers a way in for fraud, social engineering, and data theft, and many organisations have no process for spotting them.
What Catfishing Actually Means
Catfishing is the act of creating a false identity online, usually with stolen or stock photos, a fabricated backstory, and enough small, believable details to pass casual scrutiny. The term started in dating contexts, but the mechanics match many fraud and social engineering techniques used against companies. Someone builds trust using a persona that does not exist, then uses that trust to get something, whether that is money, access, information, or a foothold inside an organisation.
Why This Isn’t Just a Personal Problem
Fake identities show up in business contexts more often than people assume. A convincing LinkedIn profile with a fabricated career history can get someone past an initial screening call. A fake recruiter can extract details about your internal systems or staff structure under the guise of a hiring process. A persona built over weeks on social media can build rapport with an employee before asking for a favour that turns out to be a security incident. None of this requires technical skill, only patience and a plausible story, which is why technical controls alone struggle to catch it. The government’s Think Before You Link campaign warns that malicious actors use fake profiles on professional networking sites, and its free app helps people check a profile before accepting the connection.
How Fake Identities Lead To Real Breaches
The damage comes from what the fake profile is used to do next. A trusted-seeming contact asking for a password reset, an invoice change, or a quick file transfer is a classic pattern, and it works because it does not look like an attack. This is the territory of social engineering more broadly, where the weak point is a person’s reasonable instinct to help someone who seems genuine. If this kind of manipulation is new to your organisation, our writing on exploitation techniques that rely on trust is a useful next read, because the overlap with catfishing tactics is direct.
Artificial Intelligence Has Made This Worse
Building a convincing fake identity used to take real effort. Photos had to be stolen and edited, backstories had to be kept consistent, and conversations had to sound natural over time. Generative tools have cut that effort down substantially. Convincing profile photos can now be generated rather than stolen, written conversation can be produced instantly and adjusted to match a target’s tone, and entire personas can be maintained with far less manual work than before. That does not mean every fake account is AI-generated, but it does mean the barrier to running a convincing catfishing operation at scale has dropped. Organisations already thinking about AI-driven risk, including how these tools can be used against staff as well as by them, are better placed to recognise the pattern early.
What Businesses Can Actually Do About It
You cannot train every employee to spot every fake profile, and you should not try. Make identity verification a normal part of process. Confirm unusual requests through a second channel, such as calling a number you already hold instead of replying to the message. For recruiters, check the role on the company’s own careers page and verify the recruiter through the company’s switchboard. Confirm any change to payment or bank details with a known number. A reverse image search on a profile photo takes seconds and catches borrowed pictures. Treat urgency as a warning sign, and build a culture where checking twice is not seen as rude or paranoid.
This risk touches HR, IT, and general staff awareness at once, which is exactly the kind of risk that gets missed when nobody owns it. Give one person clear responsibility for it.
If AI-driven impersonation and fake personas are a risk you have not formally assessed yet, our AI security services for small and medium-sized businesses are a sensible place to start.
