I researched an AI dating assistant and they tried to trick me: A journalist’s guide to avoiding catfishing
Reverse image searches and facial recognition programs prove useful in verifying a user’s identity
Thomas Jenkins describes himself as “an average-looking guy who makes an average amount of money.” He believes that’s why his experiences with dating apps have been “pretty rough.” Jenkins says that “it would take me a month of swiping and chatting on them just to get a date.” Until he turned to artificial intelligence to help him with dating and found his girlfriend, that is. That’s how a report on virtual dating assistants would have begun if EL PAÍS had not noticed something suspicious. At that point, the newspaper used the following steps to verify his identity, which may be useful for avoiding possible cases of catfishing, a form of deception in which a person creates a false identity on the internet to lure victims.
Jenkins presented himself as the perfect customer for CupidBot, a service that uses artificial intelligence to search for suitors on dating apps like Bumble and chats with them until it gets dates and phone numbers. “It got me eight dates in the first month and five in the second until I found a woman I really liked; now she’s my girlfriend!” Jenkins recounted via email. CupidBot provided his contact information to this newspaper. “We asked 100 of our users if they wanted to share their experience with you, and one agreed,” the company explained.
Then something suspicious happened when asking Jenkins for a photograph of him and his girlfriend or of him using CupidBot for the article. “If you would prefer not to have your picture in the paper, we completely understand,” he was told. The response came a week later, “We don’t have many photos yet, but I’m attaching an image of us below.” The photograph in question shows a smiling man and woman in a natural setting.
A reverse search of the image on Google Lens and TinEye revealed a surprise. The photograph had been published in 2020 in an article titled “Have you howled at 8 p.m.? Get ready for Howloween!,” which told the story of Americans howling in honor of health workers during the pandemic. The person in the photo was not Jenkins. In reality, the image showed Brice Maiurro and Shelsea Ochoa, two people from Denver, Colorado. EL PAÍS contacted Maiurro to let him know about what had happened. “I’m really worried about my identity and my partner’s,” acknowledged Maiurro, who is a poet and (in theory) lives over 1,500 kilometers (932 miles) away from Jenkins.
Is it a crime to impersonate someone else or to send a photo to the newspaper in which one does not really appear in Spain? “In this case, it would not be about impersonating someone else, but about making use of someone else’s image without their consent, which is not a crime,” explains lawyer Paloma Llaneza. She says that the use of another person’s photograph could be included in a criminal offense “if it were accompanied by a deception including the transfer of assets, and that deception was insurmountable, which is the crime of fraud.” In this case, “none of those elements are present.”
When we advised Jenkins of our discovery, he made excuses: “We didn’t feel comfortable showing our faces in the article, so I found a couple of people who look a lot like us. I’m bald and she’s Colombian.” Holes started to appear in his story. And that’s when the research began. The first step was to review his previous answers. Everything he had said about CupidBot was positive. Some of his statements were similar to those the service’s creators previously made to EL PAÍS. “I wanted something that would allow me to date while I slept,” Jenkins said. Just what the company promised: “CupidBot doesn’t help you flirt; it helps you date while you sleep.”
The newspaper told Jenkins that it would not publish the story unless his identity and the veracity of the story could be confirmed. He refused to do a video call. “I didn’t think it would require me to be that involved,” he said. He only provided the newspaper with the username of a private Instagram account. Because the friend request was not accepted, EL PAÍS was unable to access the posts and verify whether the account belonged to a real person. But it did detect something suspicious: the account was created in August 2023, the same month in which Jenkins answered this newspaper’s questions.
EL PAÍS then downloaded the Instagram profile photo — the only one to which it had access — and used the PimEyes face search engine. This facial recognition program made headlines in 2021 by solving a 15-year-old unsolved mystery in a matter of seconds. The website’s creators suggest that one can use it to “find a face and check where the image appears on the Internet.” Just upload one or more photos of a person and choose whether you want to get recent matches from any time or only recent ones. But no luck: the tool did not yield any results.
However, when entering the photo of Brice Maiurro and Shelsea Ochoa in this search engine, there were multiple hits. For example, there was another image published in an article about Americans howling during the pandemic on the British website Daily Mail. Although all the photographs found can be viewed for free, one must pay to access the links where they are published.
Maldita.es, a foundation focused on the control of disinformation, has a toolbox with which any user can try to verify if content is real or a person is who they say they are. One of the services it recommends is Namechk, which is designed to check if an alias is present in different online networks and platforms.
As the ESET cybersecurity company points out, “this is useful for researchers, journalists, companies, and government agencies looking to collect online information about an individual or for people looking to find online profiles of lost friends or contacts.” The way the tool works is simple: it shows the platforms where a user with a given name does not exist in red and those where it does in green. One of the only pieces of information this newspaper had on Jenkins was his alleged name on Instagram. But the newspaper did not find any other accounts that it believes may belong to the same user.
Nor has it been possible to verify whether Thomas Jenkins actually goes by that name or whether his story is real. Therefore, the article about virtual dating assistants was published without his testimony. When told, Jenkins replied that he did not need the story to be published. “If you don’t think my Instagram is good enough, why don’t you find other users to ask? Besides, this isn’t a major government or financial issue, it’s just dating, relax.” EL PAÍS collected other testimonials and on October 5 published the report under the headline “Flirting with AI: This is how virtual love assistants work.”
What if EL PAÍS had published the photo in the article about the virtual dating assistants ?
Publishing the photograph that Jenkins provided in EL PAÍS would go against the journalist's code of ethics, according to Álvaro Orts Ferrer, the director of Orts Consultores. This privacy lawyer stresses that the people who actually appear in the photo could also claim compensation "for interference with their right to honor, privacy and self-image, as well as for a possible breach of the regulations on personal data protection."
"If Brice had noticed, he surely would have written and requested the correction and deletion of his photo," adds Samuel Parra, a lawyer specializing in technology law. Depending on how the article went, "he [also] could have demanded compensation if he had been harmed. [But] we have to bear in mind that it is not the same thing for EL PAÍS to make a mistake by putting the photograph as the new Nobel Prize winner in physics as it is for the mistake to be the photo of a man convicted of rape. I think that the former would not go beyond something anecdotal and even amusing for the person concerned, while the latter has a much more negative impact," he says.
Another dilemma that the newspaper faced when publishing the article was whether to use the name of Thomas Jenkins, as it has not been able to verify whether that is a real name. Jorge García Herrero, a lawyer specializing in data protection, explains that the name can be used "if it is newsworthy along with the story. Your basis is freedom of information, not the consent of the data subject: if the consent of the data subject had to be requested, we would never have seen news about criminals," he says. The expert believes that there is such an interest in this case: "There are people who try to trick the journalist into publishing something that interests them."
Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition
