How we identified the person behind a four-year online impersonation and catfishing campaign against Sasha
Sasha spent four years asking the police and the social media platforms to act against accounts impersonating her. Photographs taken from her own social media were being used on a network of fake profiles, sometimes in AI-edited form, across Instagram, TikTok and dating applications. Around twenty men, on her account, had at some point believed they had been speaking to her online. Some had approached her in the street. She had reported the matter to police, to cybercrime and to the platforms. Nothing meaningful had happened. It was only after her story began to attract national press coverage that the police opened an investigation, and even then no real progress had been made by the time she came to us.
It was in March 2026 that our solicitor Yair Cohen was invited onto ITV's This Morning to comment on catfishing and online impersonation. Sasha had been invited to tell her own story alongside him. The two had not met before that morning. By the end of the segment Mr Cohen had given a public undertaking, on national television, to identify the person behind the accounts and to deliver closure for Sasha. This is how that came about.
For the wider toolkit, see our notes on how we identify anonymous internet users using open-source intelligence and on how to unmask someone behind anonymous online posts.
What Sasha was facing when she came to us
Sasha is nineteen. The impersonation started when she was sixteen. She had just left school and had started college. People from her local area began texting her to ask whether the accounts using her photographs were hers. They were not.
Sasha reported the impersonation to the police. She has described their response on national television as dismissive. Social media, she was told, was a grey area, and the police were not in a position to investigate. She reported the matter to cybercrime and got nowhere. She reported the accounts to the social media platforms themselves, and the platforms told her that the accounts did not breach their community guidelines.
Meanwhile, the accounts grew. On TikTok alone, the impersonator was operating multiple accounts under the alias "Sophie Kadare", one of which reached 81,000 followers, another 32,000. The posts used Sasha's pictures alongside football edits, and at one point started using material about her late father, who had passed away. Dark humour, she has said, at first. It then became something else: an attention loop in which her grief was being mined for content.
The next stage was the spread onto dating applications. Hinge, Tinder and other apps were used to set up profiles in her name and to talk to men. She had men approach her in the street, asking her about conversations she had never had. She had men accuse her of leading them on. She has described feeling unsafe leaving her own house, because she did not know who the next person to approach her in the street would be, or why.
By the time Sasha came to us, the impersonation had been continuing for nearly four years. The accounts had been reported, removed and replaced repeatedly. Platform reporting had stopped producing meaningful change. The police investigation, which had only opened after the matter began to attract national press coverage, had still not produced anything substantive. Sasha wanted to know who was doing this to her, and she wanted it to stop.
The This Morning interview and the commitment
Yair Cohen had been invited onto the programme as a specialist internet lawyer to comment on catfishing and online impersonation in more general terms. Sasha was invited to tell her own story alongside him. The video below is the segment as it went out.
Mr Cohen had not met Sasha before that morning. He sat next to her on the sofa, listened to her account in real time, and at the end of the segment made a commitment to the studio audience and to the people watching at home. The exact words were:
"So far, I have 100% success in those type of cases. And the idea is to give Sasha also some sort of a closure, some sort of guarantee. And the way we do this is by way of going to the high court and obtaining an injunction that will enable Sasha then to have all the accounts removed. And also if the person who perpetrated those crimes repeat those actions, then they will be going to prison."
Mr Cohen had been handling matters of this shape for fifteen years by that point. He had been a public commentator on a number of catfishing cases, including the longest catfishing case in the history of the internet involving Kirat Assi, the so-called Sweet Bobby matter that went on for nearly a decade. Over those fifteen years the people behind catfishing and impersonation accounts had been identified in every matter of this shape we had handled. That track record is what allowed him to give the undertaking on air. What made him actually give it, in front of the entire nation, was what he had just heard sitting next to her. The closure had to come for Sasha. The undertaking he gave her on national television then bound us to deliver it.
Why this kind of case used to feel intractable
People who go through what Sasha went through often arrive at the same conclusion: nobody can help. Three different routes have already failed by the time they reach a specialist firm. The police have told them the matter is not actionable. The platforms have told them the conduct does not breach community guidelines. The accounts they manage to get removed are replaced inside days under new aliases.
The pattern is familiar enough that it has a shape. In our experience, the substantial majority of impersonation and catfishing matters that reach our office are perpetrated by a person the victim already knows. On the This Morning interview, Mr Cohen put the figure at roughly 95 to 96 percent. Usually it is a neighbour, a former friend, a work colleague, or sometimes a member of family or someone close to the family. That distribution is part of why the conduct is so damaging. The person targeting the victim has access to context, photographs, dates and small biographical details that an outsider could not get to easily. It is also why it is rarely random.
Catfishing itself, in legal terms, is not a separate offence. It is a method by which other wrongdoing is carried out. Breaking a window is a method of committing burglary; catfishing is a method of committing harassment. The Protection from Harassment Act 1997 is on the books. The Defamation Act 2013 is on the books. The civil remedies are on the books. The problem has rarely been the law. It has been the gap between the law and the practical question of who, in real life, is the person behind the alias. Until that question is answered, the law cannot be brought to bear. The wider definitional piece sits on our note on is catfishing illegal in the UK.
The open-source intelligence investigation, in plain terms
The technique we use to put a name to an alias is open-source intelligence, or OSINT. The full method is set out on our note on how we identify anonymous internet users using open-source intelligence. The pass is conducted by our in-house investigator, working alongside the solicitor on the file from the first call, which is not the way most law firms approach the problem. What follows is how it worked in Sasha's matter specifically.
The investigation began with a single piece of material Sasha had gathered herself, a Linktree page operating under the "Sophie Kadare" alias. Linktree is a small free service used by social media users to collect links to all their other accounts in one place. The page carried three outbound links. Two were to the "Sophie Kadare" accounts Sasha had already identified. The third was different. It pointed at an account on a different platform, under a name that was not "Sophie Kadare" at all. That third link was the first significant lead.
The next stage was username analysis. Sasha had collected a number of usernames over the years that she believed belonged to the same person, including a number of variations on the "Sophie Kadare" alias. We tested those usernames through specialist OSINT software that searches for accounts associated with a given username across hundreds of online platforms. The software returned a Linktree profile matching the one Sasha had provided, with the same outbound link to the third-platform account in the different name.
That mattered for two reasons. It independently verified the connection between the "Sophie Kadare" identities and the third-platform account, by reproducing the same finding through a separate route. It also showed that the various "Sophie Kadare" aliases were not different people who had chosen similar names. They were a single network, all routing back to the same hub.
Finding a different real-sounding name on a connected profile was a strong indication, but not yet proof of who the person was in the real world. Anyone can call themselves anything online. The verification stage involved cross-referencing the name against regulated investigative databases that lawyers and licensed investigators may use for legitimate purposes such as tracing debtors, serving legal proceedings and identifying defendants in civil claims. These databases are not freely available to the public, and their use is governed by data-protection rules and by strict requirements on purpose and proportionality.
The cross-reference produced a match. The name corresponded to a real and identifiable individual. From that point on, Sasha was no longer dealing with an anonymous account. She was dealing with a person.
The High Court claim and the route to closure
Within days of completing the open-source investigation, we issued a Part 7 claim in the High Court naming the identified individual as the defendant. The proceedings are continuing and we will not comment on them in detail while they are live.
What we can say is what the claim is for. The civil routes that became available the moment we had a name are the ones that allow Sasha to draw a line under the matter. A claim for harassment under the Protection from Harassment Act 1997 carries with it the remedy that matters here, which is an injunction restraining the defendant from continuing the conduct. Breach of that injunction is a contempt of court, with a prison sentence on the table. A claim under the Defamation Act 2013 is available where the impersonation has carried with it factual allegations that lower Sasha's reputation. The use of her photographs and AI-edited versions of them is also capable of being a misuse of private information.
The criminal route remained open in parallel. South Wales Police were investigating, and Sasha had a crime number for the first time. The civil route, however, is what we have always found delivers closure fastest in matters of this kind. The criminal threshold is high. Police resources are stretched. The civil court will give a victim of impersonation a named defendant, an injunction, and an enforceable consequence for any future breach in a way that the criminal route, even when it works, generally cannot match for speed.
What this case shows about online impersonation and catfishing
Three points from Sasha's matter are worth taking away.
The first is that the platforms and the police, between them, are not generally able to deliver the result a victim of impersonation actually needs, which is to know who is behind the accounts and to make it stop. The platforms operate by their own community guidelines, and a community-guideline removal does not identify the person or prevent the next account from being opened. The police are limited by criminal thresholds and by the resources they have available. The fact that Sasha had been carrying this for four years before a crime number was issued, and only after the national press picked up her story, is not unusual in our experience. It is closer to the norm than it is to an outlier.
The second is that, where the impersonation is sustained, the civil route is generally the faster path to closure. The civil court will grant an injunction restraining the defendant from continuing the conduct, with a prison sentence available for breach. That is a remedy with practical teeth. It is also a remedy the victim, not the police, decides whether and when to enforce.
The third is that AI-edited material is not, by itself, the end of the road. Where an impersonator has produced AI-generated or AI-edited content using a victim's likeness, the legal routes available to the victim are the same as for non-AI material: harassment, defamation, misuse of private information. The technology is changing. The civil law has not been overtaken by it. We have written about other catfishing matters where the same shape of identification and civil response produced the same kind of result: see our pages on the longest catfishing case in the history of the internet, a catfishing defamation case study and the case of XLD v KZL.
Lawyers' thoughts on this matter
This is one of those cases that stayed with the people who worked on it long after the practical legal steps had been taken. Sitting next to a nineteen-year-old on a national television sofa and listening to her describe, in her own words, what four years of being someone else online had done to her sense of safety in her own town, is not a normal way to encounter a client matter. By the end of the segment it was no longer possible to treat the situation as a piece of professional work to be evaluated on its merits and then quoted on. The matter had become personal, and the undertaking that followed was given in that register rather than in a measured solicitor's register. Whether that was wise on its own terms, on national television, is a separate question. It is what happened.
What we have taken from handling matters of this shape over the last fifteen years is that the person targeting the victim is almost never the person the victim suspects, and almost always someone closer to home than the victim is comfortable contemplating. The earliest case of this kind we handled ended with the perpetrator turning out to be the very police officer at the station where the victim had been making her complaints about him for years. That is not a story we tell because it is colourful. We tell it because the lesson it carries is the most useful single thing a victim of impersonation can read on this article. The shape of the search is to work backwards from the digital traces of the actual person rather than forwards from any list of suspects the victim has already drawn up in their own head.
The other thing worth telling a reader who is themselves in the middle of this is that the inertia they have already encountered is not personal to their case. It is structural. The platforms are scaled to remove violating accounts, not to find the human behind them. The police are scaled to a criminal threshold that most online impersonation, however damaging, does not cleanly meet. Sasha had four years of hitting both of those structural limits before the press cycle nudged things slightly, and even the press nudge did not move the substantive picture. What did move the picture was a focused civil investigation working backwards from the alias, conducted by people who do this for a living rather than passed between separate firms. That is not advertised on this article as a unique offering. It is mentioned because it is the working answer to a problem the rest of the system has not yet caught up with, and a reader in the middle of it deserves to know that there is one.
Frequently asked questions
Is online impersonation a criminal offence in the United Kingdom?
In its own right, no. Impersonation is not a free-standing criminal offence in the United Kingdom, although it is the mechanism by which other offences are often committed, including harassment under the Protection from Harassment Act 1997 and, where money is involved, fraud. The civil routes (harassment claim, defamation claim, misuse of private information) are usually the faster and more reliable way to obtain an enforceable result.
How long does an OSINT identification of an impersonator typically take?
In our experience, an open-source identification of the kind that worked in Sasha's matter is usually achieved within a small number of weeks, and sometimes days, of instructions. Some matters take longer, and a small number are not resolvable by OSINT alone and require a court order. We will tell you at the initial assessment whether your matter is one we expect to resolve by OSINT or one that will need the court route as well.
Can a High Court injunction actually stop an impersonator?
Yes. An injunction restraining a named individual from continuing the conduct is the remedy that has practical teeth. The court takes contempt of an injunction seriously, and breach can carry a prison sentence. That is what allows the victim to draw a line under the matter in a way that platform reporting and criminal investigation often cannot match.
What if the impersonator is someone I know?
In our experience, this is the more common pattern. Where the impersonator is identified as a neighbour, a former friend, a work colleague or a family member, the route is the same. The civil claim names them, the injunction restrains them, and the result holds. The fact that the parties know each other does not change the legal position. It does sometimes change the practical conversation about how the matter is resolved, which we will talk through with you at the initial assessment.
What if the impersonator has used AI-generated or AI-edited images of me?
The civil routes are the same. The use of a person's likeness, including AI-edited versions of it, in a sustained course of impersonation is capable of being harassment, of being defamation where factual allegations are attached, and of being a misuse of private information. The technology is newer than the law, but the law applies to it.
I have already reported the impersonation to the police and the platforms. Is it worth coming to a specialist firm?
Yes, in our experience. The civil route does not depend on the police investigation reaching a conclusion, and it does not depend on the platforms agreeing that anything has gone wrong. The identification and the injunction are separate from both, and they typically deliver a result on a timescale neither of the other routes can match.
Will the impersonator know that I am looking for them?
Not while the open-source investigation is in progress. Properly conducted OSINT work is not visible to the person being investigated. They will only learn that an investigation has happened when the claim is served on them in person, which is when we want them to know.
How much does a matter of this kind cost?
A precise quote follows the initial assessment. For the cluster-level cost framing across OSINT identification, Norwich Pharmacal applications and US-side work, see our note on what to expect when you instruct a disclosure lawyer. The initial assessment itself is offered at a fixed fee, so you know what the conversation is going to cost before it starts.
