Articles

Sources & references

What the evidence shows. What to do next.

Evidence and platform rules behind the risks we discuss. Each entry explains what the source actually shows, why the gap matters and which handles offering helps your team act. Original external links live here for checking.

How to use this area

Consumer losses, access surveys, breach findings and counterfeit trade are different measures. Platform guides explain rules rather than measuring risk. None of the figures directly estimates how much brand media budget is lost to fake accounts.

Scams in the social feed

Evidence of the customer harm and paid impersonation happening around brands.

US Federal Trade Commission August 2026 · 2025 reports

$95m+

Reported losses after shopping from social ads

What it measures
US consumers reported more than $95 million lost to scams that began when they ordered something after seeing a social media ad in 2025.
Scope and limits
Reported consumer losses. This is not lost brand media spend, and the scams were not all counterfeit sales.
Where handles helps

A scam can borrow a brand's identity before a customer reaches the real account. Radar helps find lookalike profiles and review eligible cases for takedown.

Explore Radar

Maldita.es investigation January 2026 · 28 Nov–23 Dec 2025

18,088

Impersonating ads found in 26 days

What it measures
Investigators identified 18,088 TikTok and Instagram ads using well-known brands’ names or images without permission during a 26-day review. The investigation examined 37 advertisers.
Scope and limits
An observed sample, not a platform-wide total. The article does not establish how much media budget or legitimate sales brands lost.
Where handles helps

Repeated impersonating accounts are hard to spot by hand. Radar scans name variations and ranks suspected accounts for investigation and platform reporting.

Explore Radar

US Federal Trade Commission April 2026 · 2025 reports

$2.1bn

Reported losses from social-origin scams

What it measures
US consumers reported $2.1 billion lost to scams they first encountered on social media in 2025. More than 40% of people reporting a social-origin scam loss said they had ordered something seen in a social ad.
Scope and limits
Consumer-reported losses across scam types, not a measure of counterfeiting or the advertising budget lost by brands.
Where handles helps

When a scam begins with a fake brand presence, Radar helps separate approved accounts from impersonators and coordinate eligible removals.

Explore Radar

Access that outlives its owner

Why identity controls need to reach business managers and social accounts.

Tailscale State of Zero Trust 2025 · survey fielded 21–28 April

68%

Had retained access after leaving an employer

What it measures
In a survey of 1,000 IT, security and engineering professionals in the US and Canada, 68% said they had ever retained access to a previous employer’s infrastructure, systems or software after leaving.
Scope and limits
A self-reported, retrospective survey. It does not measure current access across all employees or specifically social accounts.
Where handles helps

Leaver access can survive outside the company directory. Pulse compares social platform roles with approved identity records and flags mismatches for review.

Explore Pulse

Verizon 2026 DBIR, figure 31 May 2026 · 2025 dataset

36%

Breaches involved stolen credentials

What it measures
The use of stolen credentials appeared among the top action varieties in 36% of breaches in Verizon’s cross-industry dataset (figure 31, n=19,550).
Scope and limits
An action anywhere in the breach chain, not necessarily its entry point. The dataset is not specific to social media accounts.
Where handles helps

A stolen login is more damaging when it holds unnecessary privileges. Pulse maps social roles and highlights over-privileged access that needs review.

Explore Pulse

WithSecure threat research November 2022 · campaign analysis

DUCKTAIL

A real route into a brand’s ad account

What it measures
WithSecure documented malware targeting people who operate Facebook Ads and Business accounts. It used authenticated sessions to hijack business accounts and run ads for the attacker’s gain.
Scope and limits
A documented threat campaign, not a prevalence or financial-loss estimate. It concerns Facebook Business accounts, not every social platform.
Where handles helps

Unclear Business Manager ownership and admin roles make exposure harder to contain. Pulse shows Meta users, roles and ad assets together for an access review; it does not stop malware.

Explore Pulse

WithSecure threat research November 2022 · reported cases

$100k–$600k

Reported damage in targeted ad-account attacks

What it measures
WithSecure reported direct financial damage of $100,000 to $600,000 among advertising-sector companies targeted by DUCKTAIL and similar attacks on Facebook Ads and Business accounts.
Scope and limits
A reported range in affected organisations, not an average incident cost, annual total or estimate for all social accounts. The report groups DUCKTAIL with similar attacks.
Where handles helps

The reported cases show the stakes around privileged ad access. Pulse helps identify who can control connected ad assets and which roles should be reviewed.

Explore Pulse

Counterfeits beyond the feed

A sector-level estimate of the commercial stakes, kept separate from social-account findings.

European Union Intellectual Property Office January 2024 · 2018–21 annual average

€16bn

Estimated annual legitimate sales lost

What it measures
EUIPO modelled roughly €16 billion in annual lost legitimate EU sales across clothing and footwear, cosmetics and toys, using 2018–21 data.
Scope and limits
A modelled sales impact for three sectors in the EU. It is not observed social-commerce loss or a current-year figure.
Where handles helps

Counterfeit sellers can also use lookalike social accounts. Radar finds suspected impersonators so legal teams can review evidence and pursue eligible takedowns.

Explore Radar

handles data and published estimates

Our own research and operating estimates, kept distinct from independent studies.

handles Trust Index 2026 · site figures checked 7 October

57/100

Average Trust Score in the 2026 index

What it measures
The site reported an average Trust Score of 57/100 across 128 brands and 74,929 profiles classified as harmful or impersonating from 2,593,152 analysed handles at that check.
Scope and limits
handles-owned data. The live report changes as the underlying analysis updates; these numbers should be checked on publication day.
Where handles helps

A low score can reflect harmful lookalike profiles around a brand. Radar helps surface and prioritise those profiles for investigation.

Explore Radar

handles Audit overview (archived) Published estimate · date not specified · archived 16 Jun 2026

1–2 weeks

Published manual-audit workload estimate

What it measures
The handles Audit overview estimates that a manual audit of a large social estate can take one to two weeks.
Scope and limits
A company estimate, not an independently measured average or a promised amount of time saved with Pulse.
Where handles helps

A manually assembled inventory can miss roles as they change. Pulse brings connected accounts, users and ranked findings into one view for a repeatable review.

Explore Pulse

Market and platform planning

Platform rules and identity fields cited in the scenario pages. Check current guidance and the available connection fields before making account changes.

YouTube Help

YouTube handle naming rules

YouTube says handle characters can use its 75 supported languages, with script-specific length limits and some link-sharing caveats.

Scope: YouTube-specific guidance that can change; it does not set naming rules for other social platforms.

Where handles helps

Local-language names need checking against each platform's rules. Acquire can assess a proposed YouTube handle and the policy-permitted options before the brand depends on that spelling for a launch.

Acquire
Read original source

YouTube Help

Seven-day Brand Account owner wait

An owner must have held that Brand Account role for at least seven days before assigning themselves as primary owner.

Scope: Specific to YouTube Brand Account primary ownership, not a general migration timetable.

Where handles helps

A YouTube ownership handover can depend on this waiting period. Back Office can record the incoming owner, approval and outstanding platform step so the change is not signed off before it is eligible.

Back Office
Read original source

Google Workspace Developer documentation

Google Workspace directory fields

The Directory API documents searchable user fields, including identity and account status, that can help frame an access review.

Scope: Available fields and permissions depend on the approved connection. Directory MFA status does not prove social-platform MFA status.

Where handles helps

Directory status can help identify people whose recorded social roles need review. Pulse compares approved identity context with connected platform permissions, subject to the fields available in each setup.

Pulse
Read original source

ADP Developer documentation

ADP Workforce Now worker information

ADP describes worker and assignment data that may provide employment context for identity reconciliation.

Scope: The mapped fields and update cadence must be confirmed for each customer's approved integration.

Where handles helps

Employment and assignment changes can reveal a leaver or moved colleague whose social access needs checking. Pulse compares approved HR context with observed platform roles when the relevant fields and connection are agreed during setup.

Pulse
Read original source

ISO/IEC 27001 and social access governance

ISO's overview of information-security management and access. These sources frame where a social asset inventory and access review may support an organisation's own ISMS.

International Organization for Standardization

The ISO/IEC 27000 family

ISO identifies ISO/IEC 27001 as the requirements standard for an information security management system (ISMS) and ISO/IEC 27002 as guidance on information-security controls.

Scope: A family overview, not a checklist for any one product or proof of an organisation's conformity.

Where handles helps

Pulse gives teams an inventory of connected social assets and their access context to consider in the organisation's wider risk and control process.

ISO/IEC 27001 readiness
Read original source

International Organization for Standardization

ISO/IEC 27001:2022 · ISMS requirements

ISO describes a system for establishing, operating and improving information security through an organisation-specific risk-management process.

Scope: Conformity and certification concern the organisation's ISMS and its assessed scope. Using Pulse alone does not establish either.

Where handles helps

Pulse can surface connected social assets, recorded ownership and access exceptions for teams to assess and document within their own ISMS.

ISO/IEC 27001 readiness
Read original source

International Organization for Standardization

ISO/IEC 27002:2022 · control guidance

ISO explains that 27002 offers guidance on information-security controls, including access control, alongside the ISMS requirements in 27001.

Scope: Control selection and implementation depend on the organisation's risks. ISO's public overview does not supply the full control text.

Where handles helps

Pulse's connected asset, identity and permissions view can inform reviews of selected inventory and access controls where those controls apply.

ISO/IEC 27001 readiness
Read original source

International Organization for Standardization

Access control in information security

ISO explains how identity, roles and permissions govern who can access a resource and at what level.

Scope: General access-control guidance. The organisation must define and enforce its own access rules on each platform.

Where handles helps

Pulse shows observed roles on connected social assets so owners can compare access with their policy and investigate exceptions.

ISO/IEC 27001 readiness
Read original source

International Organization for Standardization

Identity management and access privileges

ISO describes identity lifecycle and entitlement management, including changes when a person joins or moves roles and regular review of access.

Scope: Educational guidance. Directory or HR status does not by itself prove the status of a social-platform account.

Where handles helps

When approved identity fields are available, Pulse can compare worker context with connected social roles and flag mismatches for human review.

ISO/IEC 27001 readiness
Read original source

Control and rights guidance

Regulatory, framework and platform guidance cited by the Legal, IT and Security team pages.

UK Information Commissioner's Office

Data security under UK GDPR

ICO guidance covers appropriate technical and organisational security measures for personal data, including access controls.

Scope: General regulatory guidance, not a conclusion that a particular social account or deployment is GDPR compliant.

Where handles helps

Where a social account handles personal data, unknown or excessive access deserves review. Pulse surfaces recorded permissions so the account owner can check them as part of the organisation's wider data-security work.

Pulse
Read original source

X Help Center

Trademark reports on X

X sets out who can submit a trademark complaint and the information its review process requires.

Scope: Platform policy, not a promise that every report will result in a takedown.

Where handles helps

A claim needs rights-holder authority and account evidence before it reaches X. Radar brings suspected impersonation and the relevant profile evidence into review, then keeps the platform response with an approved claim.

Radar
Read original source

US National Institute of Standards and Technology

NIST CSF 2.0 · PR.AA-05

The framework calls for defined, reviewed and enforced access permissions, entitlements and authorisations.

Scope: A recommended control outcome, not a product certification or measurement of Pulse effectiveness.

Where handles helps

Permissions scattered across business managers are easy to leave unreviewed. Pulse makes observed social roles and mismatches visible so the responsible platform owner can decide which access to change.

Pulse
Read original source

US National Institute of Standards and Technology

NIST CSF 2.0 · RS.AN-06

The framework addresses recording actions during an investigation and preserving the integrity and provenance of records.

Scope: A response-process reference, not a claim that Pulse stores a complete forensic history.

Where handles helps

When a suspected impersonator is investigated, the finding, submitted claim and platform answer should remain distinguishable. Radar keeps case evidence and claim status together for review; a full forensic record needs separate controls.

Radar
Read original source

Research cited in articles

Additional studies in the article library. Older or broad figures are labelled so they are not mistaken for current social-account risk rates.

US Federal Trade Commission · 2023 Data Spotlight

Investment losses among social-origin scams

The FTC reported that investment scams accounted for more than half of reported losses to scams originating on social media in the first half of 2023.

Scope: A historical US consumer-report figure, not a current-year or counterfeit-commerce estimate.

Where handles helps

The reported harm gives financial brands a reason to examine suspicious accounts using their names. Radar prioritises candidate impersonators for evidence review and eligible platform claims; it cannot address every kind of investment scam in this figure.

Radar
Read original source

Microsoft Security · 2019

MFA and automated account attacks

Microsoft reported that MFA blocked more than 99.9% of automated account-compromise attempts in the sign-in activity it studied.

Scope: Dated Microsoft telemetry; not a universal guarantee or a social-platform-specific outcome.

Where handles helps

MFA enrolment is an account task that can be missed on older profiles. Back Office can queue an approved two-factor and recovery-route check, then record the completed change; Microsoft's result is not a measured social-platform outcome.

Back Office
Read original source

Platform policies cited in articles

First-party rules behind article guidance. Platforms can update these policies without notice.

TikTok Support

TikTok verification criteria

TikTok explains the meaning of a verified badge and the signals it considers in verification.

Scope: Platform policy, not an offer of guaranteed verification.

Where handles helps

TikTok's criteria determine whether an account receives a badge. Back Office can prepare and track an authorised verification application, while TikTok makes the decision.

Back Office
Read original source

Instagram Help Center

Instagram username and account terms

Instagram's terms govern use of accounts and usernames, including prohibited sale or transfer of account features.

Scope: Policy can change and does not guarantee that an inactive username is available for recovery.

Where handles helps

An unavailable username cannot be treated as a simple private purchase. Acquire assesses the name and any permitted path under the platform's rules before a brand commits its launch identity to it.

Acquire
Read original source

Meta Business Help Center

Meta business Page access

Meta documents the access roles and business relationships that affect who can manage a Facebook Page.

Scope: The exact controls visible depend on the account and Meta's current interface.

Where handles helps

A Page may sit inside a business relationship the brand has not recorded. Pulse brings connected Pages and observed access into one inventory so the owner can review who can manage each asset.

Pulse
Read original source

TikTok Business Help Center

TikTok asset-level permissions

TikTok describes Business Center asset permissions used when allocating account access.

Scope: The supported roles and steps are platform-specific and may change.

Where handles helps

Access to one TikTok asset can differ from access to another. Pulse surfaces the recorded roles per connected asset so a reviewer can spot permissions that exceed a person's current job.

Pulse
Read original source

TikTok Business Help Center

TikTok account and Business Center roles

TikTok describes how a business account can integrate with Business Center and be managed through assigned roles.

Scope: Role availability depends on the account configuration and current platform rules.

Where handles helps

An agency or team handover needs the Business Center relationship and assigned roles checked before access changes. Pulse makes the recorded account relationship and current roles visible for that review.

Pulse
Read original source

YouTube Help

YouTube channel permissions

YouTube describes delegated channel access through channel permissions and its role model.

Scope: Not all YouTube channels use the same account configuration; check the current setup before migration.

Where handles helps

Delegated channel roles can outlive the people who needed them. Pulse lets the account owner review observed access in the wider social estate, then confirm any YouTube role change in the channel's own settings.

Pulse
Read original source

YouTube Help

YouTube Brand Account ownership

YouTube describes owners, managers and transfer steps for Brand Account-linked channels.

Scope: Includes a seven-day owner wait; channel permissions and Brand Account ownership are distinct.

Where handles helps

A channel's manager role does not settle who owns its Brand Account. Back Office can keep the ownership request, approval and native YouTube steps together until the handover is verified.

Back Office
Read original source

LinkedIn Help

LinkedIn Page admin roles

LinkedIn documents the admin roles available for managing a Page.

Scope: Only the platform's current role model governs an actual Page.

Where handles helps

A LinkedIn Page can retain admins after a team change. Pulse gives the owner a cross-platform access review so each recorded admin role can be checked against current responsibility.

Pulse
Read original source

X Help Center

X Delegate roles

X documents delegated account roles and permissions for collaborators.

Scope: Delegation does not establish legal ownership or override platform policy.

Where handles helps

Collaborators may have publishing powers without owning the X account. Pulse helps the account owner review recorded delegated access and investigate roles that should have ended with an agency or employee relationship.

Pulse
Read original source

Instagram Help Center

Instagram verification requests

Instagram describes the verification-request process and its review criteria.

Scope: A request does not guarantee a verified badge.

Where handles helps

An Instagram badge request has its own evidence and review steps. Back Office can prepare and record an authorised application, but Instagram decides whether the badge is granted.

Back Office
Read original source

Meta Help Center

Verified badges on Meta platforms

Meta explains verified-badge meaning and the distinction between verification routes.

Scope: The badge and eligibility rules vary by product, account type and market.

Where handles helps

Meta's different badge routes need to be checked for the particular account and market. Back Office can record the chosen route and any authorised application, without treating submission as approval.

Back Office
Read original source