How to identify an online scammer with OSINT

Behind every scam lies a digital trail. Here is what OSINT can uncover — legally — the checks you can run yourself, and where a professional investigation takes over.

By the ScamHunter.ch investigation team · Updated 19 July 2026 · 8 min read

Scammers rely on anonymity, but they almost always leave clues behind: a reused photo, a recently registered domain name, a crypto wallet, a traceable phone number. OSINT (Open Source Intelligence) means using these publicly accessible traces to reconstruct an identity — without ever resorting to hacking.

What OSINT can and cannot do

OSINT draws on publicly accessible data: search engines, social networks, company registers, domain-name information, public blockchains, data breaches that are already public. It is a legal investigative method.

The checks you can run yourself

First of all, these simple, legal steps can already reveal a great deal:

1. Reverse image search

Submit your contact's profile photo to a reverse image search engine. If the same photo appears under other names or on stock-image libraries, that is a strong sign of impersonation.

2. Cross-referencing the number, email and username

Search for the phone number, email address or username in quotation marks in a search engine. They sometimes surface on forums, classified ads or scam-reporting pages.

3. Domain name analysis

For a fake website, the domain's creation date is telling: an "investment" site created a few weeks ago should raise a red flag. Public domain information (WHOIS) and the hosting provider give the first clues.

4. Checking the financial details

An IBAN, a beneficiary name or a crypto wallet address can be searched in community reporting databases. Also check the FINMA warning list for financial platforms.

The clues investigators work with

Beyond these checks, a professional investigation methodically cross-references many sources to turn isolated clues into a body of evidence:

• Correlating digital identities: usernames, profiles, email addresses and phone numbers linked together across platforms.
• Infrastructure analysis: domain names, hosting, scripts and tools reused from one scam to the next.
• Tracing money flows: following payments and, on public blockchains, the path of cryptocurrencies through to a regulated service.
• Temporal and geographic cross-referencing: combining the elements to bring out patterns and a presumed perpetrator.

To go further on the financial side, see our guides on recovering your money after a crypto scam and fake trading site: recovering your funds.

Traps and risks to avoid

• Do not confront the scammer: you would tip them off, they would erase their tracks and could make the evidence disappear.
• Do not attempt any intrusion: beyond the criminal risk, evidence obtained illegally is unusable.
• Never pay "to identify" the scammer to a stranger who approaches you: it is often a second scam.
• Preserve everything: time-stamped screenshots, URLs, transaction IDs, complete conversations.

When to hand the investigation to professionals

Personal checks quickly reach their limits: access to tools, time, methodological rigour and, above all, evidentiary value. A professional OSINT investigation legally cross-references the sources, documents every step and produces a structured report linking the elements to a presumed perpetrator. This report can be used by your lawyer and the authorities to support a complaint, a seizure or a refund request.

The ScamHunter.ch investigation team

Investigators specialising in OSINT, tracing money flows and digital investigation after online scams. Based in Switzerland, in Geneva.

This article is for information only and is not individual legal advice. For any decision, consult a qualified professional about your situation.