Social Media Identity Theft Ring

A sophisticated identity theft ring has been creating fake social media profiles using photos stolen from genuine accounts. Kolkata Police have identified 500+ fake profiles. Students will analyze network structures, profile creation patterns, and money transfer chains.

# Aplly.xyz Case Study Submission

## Title
Social Media Identity Theft Ring

## Type
Cybercrime & Digital Forensics

## Difficulty
Intermediate

## Estimated Time
60 minutes

## Overview
A sophisticated identity theft ring has been creating fake social media profiles using photos stolen from genuine accounts. Kolkata Police have identified 500+ fake profiles. Students will analyze network structures, profile creation patterns, and money transfer chains.

## Case Details

Function Focus: Cybercrime & Digital Forensics — manual reasoning, decomposition, and critical judgment (no spreadsheet or AI tool permitted in Phase 1)

Scenario:
You are the analyst at a fictional consultancy ("Praxis Advisors") tasked with answering: Social Media Identity Theft Ring. You have a clean, synthetic dataset described below. You must produce a defensible answer using structured reasoning — no tool-assisted shortcut on the first pass.

Dataset Structure:
- victim_id
- platform
- account_age_months
- followers_count
- impersonator_handle
- similarity_score_pct
- fake_accounts_detected
- stolen_posts_count
- reported
- action_taken
- ransom_demanded

Tasks:
1. Sort/segment the records to isolate suspicious entities (IPs, accounts, devices). Do this by hand first.
2. Map the connections between entities into a network; identify hubs, bridges, or high-risk clusters.
3. Correlate timestamp/event columns to reconstruct an attack or fraud timeline and locate the first-mover root source.
4. Score or rank candidate entities by risk using the dataset columns, justifying weights explicitly.
5. After your manual pass, re-run the risk ranking in a tool and reconcile any differences.

Expected Output:
A one-page incident analysis memo: suspect/entity shortlist with risk scores, network/timeline map, root-source identification.

Evaluation Criteria:
Soundness of the network/timeline reconstruction, correct risk-scoring methodology, evidence integrity reasoning.

## Data Sources

| victim_id | platform | account_age_months | followers_count | impersonator_handle | similarity_score_pct | fake_accounts_detected | stolen_posts_count | reported | action_taken | ransom_demanded |
|---|---|---|---|---|---|---|---|---|---|---|
| V001 | Instagram | 24 | 12500 | @official_v001_fan | 85 | 45 | 32 | True | Takedown | |
| V002 | Twitter/X | 36 | 85200 | @real_v002_x | 92 | 120 | 158 | True | Account restored | |
| V003 | LinkedIn | 48 | 3500 | @v003_consulting | 78 | 18 | 12 | True | Profile removed | |
| V004 | Facebook | 60 | 28000 | @official_v004_fb | 88 | 67 | 89 | True | Pending | |
| V005 | Instagram | 12 | 5200 | @v005_original_ | 82 | 32 | 28 | True | Takedown | |
| V006 | YouTube | 36 | 45000 | @V006_Channel_HD | 90 | 28 | 45 | True | Channel suspended | |
| V007 | Reddit | 18 | 1500 | | 0 | 5 | 0 | False | None | |
| V008 | Discord | 6 | 800 | @v008_admin | 95 | 250 | 0 | True | Server closed | 500 |
| V009 | Instagram | 48 | 95000 | @v009_real_ig | 94 | 180 | 420 | True | Under review | |
| V010 | Twitter/X | 24 | 12000 | @v010_fanpage | 80 | 15 | 18 | True | Takedown | |


Full dataset: https://github.com/arora200/aplly_case_db/datasets/061-cybercrime-identity-theft (synthetic, 15 records)

## Solution Frameworks
Network/graph analysis, log correlation, kill-chain mapping, anomaly detection, chain of custody & evidence integrity

## Solver Guidance & Tutorials
_Solver guidance added by the pipeline (tutorial links) — see `solver_guidance` field._

## What You'll Learn
- Map relationships into actionable networks
- Reconstruct attack timelines from logs
- Score risk from raw attributes

## Tags
Cybercrime, Identity Theft, Social Media Forensics, Network Analysis

## Registration Links
Register as Solver / Register as Evaluator