Who's that girl? The curious case of Leah Palmer

Ruth Palmer discovered that she was a victim of online identity theft

Have you met Leah Palmer?

She is an attractive, single, fun-loving 20-something Briton currently living the high life in Dubai.

She has an active social-media presence and often chats with family and friends on sites such as Facebook, Instagram and Twitter.

If you are a man, you might even have spotted Leah on dating app Tinder, looking for romance.

Ignore the man in the photo. He is her nasty ex-boyfriend.

Actually, Leah Palmer does not exist.

The woman in the photograph is Ruth Palmer, and she is happily married to Benjamin Graves.

He is not a horrible former partner, he is her husband.

In the fake account, Ruth's husband is portrayed as a psychotic ex-boyfriend

Ruth recently discovered that for the past three years somebody has been routinely lifting photographs of her, her family and friends from social networks, and setting up a network of fake media profiles of them - which all communicate with each other.

This person, calling themselves Leah Palmer, branded Ruth's husband a "psychotic ex" in her version of Ruth's photos and had online relationships with at least six different men, who all thought they were cyber-dating Ruth - the woman in the pictures.

While Ruth has 140 followers on Instagram, Leah has more than 800 - and all her photographs, more than 900, are of Ruth and her friends.

Weird things

The first fake account was closed down, but another one popped up soon after

Ruth only discovered her cyber-double in January this year.

"One day after work, one of my old university friends sent me a message and said, 'Have you seen this image, do you know who it belongs to?'" she told the BBC.

"She sent me a photo of myself and some university friends from four years ago, but it was a screenshot taken from someone else's account on Instagram.

"I didn't know what was going on, so I asked my friend to go on her account and have a look and see if she had any more.

"There were just loads and loads of images, not just of me, there was me with my friends, pictures of just my friends,"

How common is online identity theft?

The term "catfish" is sometimes used to describe the practice of using other people's photographs when looking for relationships on the net.

The name comes from the 2010 documentary Catfish, now also an MTV series.

It charted an online relationship between a young man and a woman who turned out not to be as she seemed.

"It happens a fair amount," said web security expert Graham Cluley.

"Many people find it difficult to get the social networks to take action."

Generally, people were unaware their photo was being used elsewhere, unless they found out by chance, Mr Cluley added.

"There are search engines for photos such as Tineye.com, where you can upload an image and see where it appears on the web," he said.

Ruth said the images came from a mixture of social-media sources - both from her own accounts and those of her friends.

"There was a picture of my closest friend with her sister," Ruth said.

"She claimed that my friend was her friend and said my friend was a mum.

"She had written weird things about her, like, 'Oh she's so gorgeous, and she's a mummy, you'd never think it.'

"It was all very weird, and untrue."

When she discovered the fictional Leah was also contacting men via these profiles, Ruth was able to make contact with some of them, via Skype, with her husband at her side.

They had soon realised what had happened, Ruth said, not least because the young woman they had been faced with, who they had thought they had spoken to on the phone, had had a completely different accent.

Ruth said: "Some of these guys... they'd had online relationships with her, they'd been exchanging explicit images... I can't imagine.

"When they were talking to me, you could see it was like someone going through a break-up.

"One had ended a real-life relationship to have an online relationship with this girl who they thought was me."

One man told Ruth he and Leah had got together on Tinder.

"I didn't even know what Tinder was," Ruth said.

Ruth Palmer tried to contact Leah via phone numbers passed on by men she had been involved with

"It's some dating app, right?"

Ruth tried to call "Leah" on the phone numbers she had given to the men.

"I have tried to phone her lots of times," she said.

"She had two phones. The first one rang through, she picked up, all I said was, 'Hello,' and within two seconds she put the phone down.

"After a good week or so both numbers were not in use."

The men said sometimes they had spoken to two of "Leah's friends", who had been with her at the time of the call.

"Somebody out there knows who she is and what she's up to," Ruth said.

Detective work

Ruth contacted the social-network companies, who she said had been quick to remove the fake profiles - but they soon sprang up again.

The police offered victim support, but as no crime had actually been committed and the person was not using Ruth's full name, they could only file her case "for information".

She said she had always kept her social-media accounts on the maximum privacy settings.

"My Facebook and Instagram are private and have always been private," she said.

"I don't have a public profile or pages. I never had them because I am fully aware that there are people out there who can go on pages and do this sort of thing.

"I've been trying to do my own detective work, and the only thing I can think is that maybe when I first joined Instagram perhaps I had an open profile very briefly."

Leah Palmer's double life appears not to have fooled all her followers

The obvious uncomfortable thought is that "Leah" is somebody Ruth knows.

"I can't think of anybody who would want to do this - but you never know," she said.

"The only thing I do know is that whoever is doing this has lots of time on their hands.

"They've created profiles of my mum, my friends... and all these fake accounts are having conversations between each other."

Despite all this, Ruth has not turned her back on social media.

"I'm an expat - it's great to see pictures and news from family and friends at home," she said.

"My generation has been geared up to using social media."

She shared her story with British local paper, the Brighton Argus, because she wants not sympathy, but action.

Ruth said she had heard from others with similar experiences.

"Identity theft or fraud shouldn't just be classified commercially," Ruth said.

"Children are using smartphones in schools, you hear about trolls and online bullying, this is another one of those very difficult cases that I think needs to be included.

"What can you do if social media goes wrong? There should be something - whether it's support or a law change."

Honey pot

The one thing Ruth does have is control of her photo's copyright

Security expert Prof Alan Woodward, from Surrey University, said: "It's a classic online honey pot.

"To be fair to the police, what can they do?

"If someone is just misusing an image, what can you do?

"There are millions of images uploaded on to the internet every day.

"Can the police stop all illegal copying?

But Prof Woodward added: "I cannot help but think there is a crime in there somewhere, otherwise why would somebody bother?

"It is a precursor to fraud.

"People can end up having very intense relationships online with people they have never met."

Copyright rules

Prof Woodward urged caution with social-media use, whatever the privacy settings.

"Personally I don't think you should put anything on the web that you wouldn't be happy about being published in a local newspaper," he said.

"Privacy settings change, search terms change... images only need to be available for a couple of minutes to be copied on to somebody else's machine."

Copyright lawyer Adam Rendle said Ruth's recourse may be through the photographs that had caused the problem in the first place.

"The imposter will not own the copyright in the photos and videos of the victim that he or she is using - the person who took them is likely to," he said.

"The victim could therefore try to use the copyright to stop the imposter using that material.

"Platforms will typically respond to takedown requests based on copyright."