How platforms detect fake networks

Investigations and automation

Meta's May 2021 report said expert investigations are hard to scale. Its investigators identify the behaviours and signatures of a network and then automate detection of them ¹. The same report said Meta finds and blocks millions of fake accounts every day, often within minutes of creation ¹.

Meta said most CIB networks it disrupted in the year before that report had fake accounts that were already disabled before investigators began work ¹. OpenAI said in May 2024 that its own AI tools let investigations finish in days rather than weeks or months ⁵.

Behaviour, not content

Meta says it focuses on behaviour when it investigates and takes down these campaigns, not on the content they post ². OpenAI said in its October 2025 report that its approach focuses on patterns of threat actor behaviour rather than isolated model interactions ⁶.

Operators make mistakes that help investigators. OpenAI reported in May 2024 that some operators posted model refusal messages in public ⁵.

Tips and shared indicators

• Peer tips: Meta said Google Threat Intelligence Group shared information that helped start its investigation of an Iran network reported in May 2025 ³.
• Internal work: Meta said the Romania network in the same report was found through an internal investigation ³.
• Public indicators: Meta points readers of its Q4 2024 report to a GitHub repository of threat indicators ⁴.
• Industry sharing: OpenAI said in October 2025 that it shared indicators with industry partners and that indicators in its casework overlapped with a Trellix report ⁶.
• Research and law enforcement: Meta's 2021 report said it shares information with independent researchers, industry peers and law enforcement ¹.

Networks that come back

Removed networks often try to return. TikTok said on 23 May 2024 that its new covert influence operations report would include new information about operations it had previously removed ⁷. In December 2024 TikTok reported 9 operations disrupted in October, comprising 486 accounts, and 3 in November, comprising 154 accounts ⁸. The same post reported further accounts linked to previously disrupted networks that tried to re-establish themselves ⁸.

Meta reported in December 2025 that operators of a network aimed at sub-Saharan Africa, which it said was likely working on behalf of individuals in Russia, came back after removal using fake accounts ⁹.

What detection says about reach

Detection reports often record small audiences. Google said in January 2023 that most DRAGONBRIDGE channels had 0 subscribers when disrupted and over 80% of its videos had fewer than 100 views ¹⁰. Meta cautions that sharing a network's links or interacting with it is not enough to attribute accounts to a campaign without corroborating evidence ³.