Facebook OSINT: How to Investigate What's Actually Public

A Facebook profile rarely lies outright. It exaggerates, omits, and gets stale — a job title nobody updated after a promotion, a hometown left over from years ago, a friend list that says less about closeness than it looks like it does. The real skill in Facebook OSINT isn't finding data. Facebook still holds an enormous amount of it. The skill is knowing which piece of it actually answers the question in front of you, and which piece just feels like it does.

We run this kind of review as part of due diligence, background checks, and fraud investigations — not as a stand-alone hobby, and not in isolation from OSINT as a discipline generally. What follows is the methodology behind it, applied to one specific platform: what a profile can genuinely tell you, where automated tools quietly overstate their own certainty, and where the line sits between investigating and overreaching.

Why Facebook Still Matters for OSINT

Meta no longer publishes a Facebook-specific user count — its most recent results report only a combined "Family Daily Active People" figure of 3.60 billion across Facebook, Instagram, WhatsApp, and Messenger as of June 2026, up 3% year over year. We mention that not to inflate the number, but because the source material behind this kind of guide often recycles an old single-platform figure as if it were still current. It isn't, and a guide built on stale numbers isn't one worth trusting on the harder questions either.

What hasn't changed is Facebook's demographic spread. Unlike platforms skewed toward a single age group, Facebook's user base still spans generations — which is exactly why it keeps turning up in investigations that have nothing to do with young, terminally-online subjects: a supplier's declared director, a job candidate in their fifties, a business partner's adult children.

There's a sharper reason it matters now than it did a few years ago. The U.S. Federal Trade Commission reported in April 2026 that people lost $2.1 billion to social media scams in 2025 — an eightfold increase since 2020 — and that losses tied to scams starting on Facebook specifically outpaced every other social platform, and every email or text scam combined. Investment scams alone accounted for $1.1 billion of that total. Why this matters: a counterparty, a candidate, or a "prospective investor" encountered partly through Facebook isn't a hypothetical risk category anymore — it's the single most common one Facebook itself sits at the center of.

What a Facebook Profile Actually Reveals

A profile is really several layers of data, each with a different reliability ceiling.

• Basic information — name, location, hometown, birthday — set by the user and gated by their own privacy settings. Useful for confirming identity, weak as a stand-alone fact if it hasn't been updated in years.
• Employment and education — job titles, employers, schools — helpful for corroborating a CV or a declared role, but self-reported and sometimes years stale.
• Network — friends, family connections, group memberships — shows association, not endorsement. A shared friend, a family tag, or a group membership tells you two accounts are connected; it does not tell you why, or how closely.
• Interests and check-ins — pages liked, groups joined, locations tagged — can indicate a pattern of behavior over time, but a single like or a single check-in is a data point, not a conclusion.

Why this matters: every one of these layers is a lead, not a finding. Treating a friend-of-a-friend connection or a years-old job title as confirmed fact is exactly how an investigation ends up with the wrong person, or the right person and the wrong conclusion about them.

Verifying Media: Photos, Video, and Where the Trail Runs Cold

Images and video carry more forensic weight than text — when the platform hasn't already stripped it out.

Facebook removes EXIF metadata (GPS coordinates, device details, timestamps) from uploaded photos and videos as a matter of course. That single fact rules out one entire category of shortcut: you are not going to pull a location out of a photo's metadata once it's gone through Facebook's own upload pipeline. What's left is what the image or video actually shows, and reverse image search is the tool that does the most legitimate work here — checking whether a profile photo, a "product," or a claimed location appears somewhere else first, under a different name or a different story. Google's and Bing's reverse image tools and TinEye all serve this purpose; none of them require getting past a platform's own privacy controls to be useful, because the comparison happens against the open web, not against Facebook's internal data.

Two things we deliberately don't recommend as investigative technique: running a profile photo through facial-expression or "emotion analysis" software, and treating that output as a finding. The underlying science is genuinely disputed, and a probabilistic guess about someone's emotional state dressed up as a data point is the kind of thing that looks rigorous and isn't.

Why this matters: a media review is strongest when it stays inside its actual limits — confirming or contradicting a specific, checkable claim (this photo, this location, this timeframe) rather than reaching for a psychological read that no verification standard would actually support.

Establishing Identity: IDs, Usernames, and Cross-Platform Signals

Every Facebook account has a numeric ID behind the username, and the two aren't always the same as the display name a person chooses to show. That gap is itself useful: a display name is curated; a username, often set once and rarely revisited, is more likely to carry over unchanged from an older account, an earlier platform, or a personal habit.

Cross-referencing a username or alias across platforms is a legitimate and common technique — people reuse handles more often than they think, and a consistent alias across Facebook, a forum, and a professional network is a real investigative lead. It is still a lead, not a conclusion. A shared username narrows the field; it doesn't confirm two accounts belong to the same person until something independent corroborates it — a matching photo, a matching employer, a matching location, ideally more than one of those together.

Why this matters: identity correlation is where false positives do the most damage, because a wrong match doesn't just add noise — it can send an entire investigation after the wrong individual. One matching detail is a hypothesis. It becomes a fact once a second and third independent detail line up behind it.

Reading Posts, Reactions, and Engagement — Cautiously

Post content is the richest and the most misleading layer at the same time. Text, links, tags, and check-ins inside a post can corroborate a claim about someone's whereabouts, associations, or opinions on a specific date — genuinely useful when the timestamp and the content both hold up under a second look.

Reactions, comments, and shares get read too confidently in a lot of casual OSINT work. A "Like" is a weak signal of agreement at best — plenty of likes are reflexive, ironic, or aimed at a friend rather than the content. Reading a pattern of likes or group memberships as proof of a specific ideological position is a common overreach, and it's the kind of conclusion that doesn't survive a second reviewer asking "what's the actual evidence for that."

Two practical notes worth applying every time: Facebook's post-timestamp display depends on the viewer's own device settings, so a timestamp needs cross-checking rather than taking at face value, and content a subject has since deleted or edited is sometimes still recoverable through the Wayback Machine's archived snapshots — useful when a claim's timing is exactly what's in dispute.

Why this matters: engagement data answers "did this account interact with this content" reliably. It does not reliably answer "what does this person believe" or "how significant is this relationship" — and an investigation that conflates the two is building a conclusion on a foundation it hasn't actually earned.

From Signal to Confirmed Fact

Every technique above produces a signal, not a finding. The discipline that turns a signal into something an investigation can actually rely on is the same one behind OSINT methodology generally: define the question before collecting, weigh each source's reliability rather than its convenience, actively look for the version of events that contradicts your working theory, and require independent corroboration — ideally from outside Facebook entirely — before a lead becomes a stated conclusion in a report.

A profile that "looks like" a match is a hypothesis. A name, a location, an employer, and a photo that all independently line up across two unrelated sources is closer to a fact.

How This Looks in Molfar's Practice

A recurring pattern from our own case work, anonymized: a client asks us to verify a prospective business partner ahead of signing — someone they've only met through a mutual introduction, largely on the strength of a confident, active-looking Facebook presence. The profile shows a consistent employment history, a wide, plausible-looking network, and years of ordinary posts.

Two things don't line up once we go past the profile itself. The stated employer has no public record of the role at the claimed dates — not necessarily damning on its own, since roles go undocumented all the time, but worth a second look. And the "wide network" turns out to be heavy on accounts created within the same few-month window, several with minimal independent history of their own — a pattern that shows up around manufactured social proof far more than it does around an ordinary personal account.

Neither fact alone would justify walking away from the deal. Together, cross-checked against corporate and public records outside Facebook entirely, they were enough to justify a fuller due diligence pass before any commitment was made — which is exactly the outcome a profile review is supposed to produce: not a verdict, but a clear, evidenced case for what needs checking next.

Legal and Ethical Boundaries

Public visibility is not the same thing as unrestricted permission. A post being viewable doesn't remove it from data protection law, doesn't waive the platform's own terms of service, and doesn't authorize scraping at scale, automated bulk collection, or attempts to get past a privacy setting rather than working within it.

A few boundaries worth stating plainly rather than assuming they're obvious: collection should stay scoped to what the specific question actually requires, not expand just because more is technically visible. Personal data — a phone number, an email, a family member's name — carries the same legal weight whether it was hard to find or one click away. And nothing in a legitimate OSINT review involves attempting to access a private account, bypassing a login, or acquiring data through deception; that's a different activity entirely, and it's the point where an investigation stops being defensible.

Where a Facebook Review Fits in a Larger Investigation

On its own, a Facebook review answers a narrow question. It earns its place inside something bigger:

• Verifying a business partner or supplier — cross-checking a declared identity and network against third-party due diligence findings from corporate and public records.
• Screening a candidate for a sensitive role — as one input among several in a properly scoped background check, not a stand-alone verdict.
• Assessing reputational exposure — patterns of association or public statements feeding into reputational due diligence ahead of a partnership or investment.
• Flagging risk signals early — a fraudulent or impersonation-heavy Facebook presence is exactly the kind of signal adverse media screening is built to catch before it becomes a bigger problem.
• Locating a specific individual across platforms — Facebook is one piece of a wider search; see our general guide to finding someone on social media for the cross-platform version of this methodology.

Frequently Asked Questions

What is Facebook OSINT?

‍The practice of gathering and verifying publicly or commercially available information from Facebook — profiles, posts, media, and network data — to answer a specific investigative question, rather than browsing casually.

Is it legal to investigate someone's Facebook activity?

‍Using information a person has made publicly visible is generally permitted, but how it's collected, combined, stored, and used is still governed by data protection law, the platform's own terms, and — for anything involving an employment decision — labor law. Attempting to access private content, or collecting more than a specific question requires, moves outside what's defensible.

Can Facebook data alone confirm someone's identity?

‍Rarely on its own. A profile detail is a lead until it's corroborated by at least one independent source outside Facebook — a public record, a second platform, a document. Treating a single matching detail as confirmation is the most common source of a wrong identification.

Why doesn't this guide recommend more third-party lookup tools?

‍Because a long tool list isn't the same thing as a methodology, and several commonly recommended categories — bulk data-broker lookups, breach-database searches on someone else's leaked credentials, "emotion analysis" from a photo — carry real legal, ethical, or evidentiary problems that a genuinely rigorous review shouldn't paper over with a link.

How does a Facebook review fit into due diligence or a background check?

‍As one input, not the whole answer. What it reliably contributes is corroboration or contradiction of a specific claim — an employer, a location, a stated connection — which then gets weighed alongside corporate records, public filings, and other independent sources before anything becomes a conclusion in a report.

‍