Spot the Bot: Notes and Takeaways
How to spot fake accounts and sort fact from fiction in social media.
This week I virtually attended an excellent “Lunch & Learn webinar” hosted by the Center for North Carolina Politics and Public Service at Catawba College, titled “Spot the Bot: How to spot fake accounts and sort fact from fiction in social media.” The presenter was Torry Crass, former Chief Information Security Officer for the state of North Carolina and former agency CISO for the NC State Board of Elections. The webinar was facilitated by Dr. Michael Bitzer, a professor of politics and history at Catawba College.
The full recording is archived on YouTube, and I encourage you to watch it — especially if you’re a teacher, a parent, or anyone concerned about what’s happening to our information ecosystem heading into the November 2026 elections.
Is This Even a Real Problem?
Torry opened with a question he said he hears often: is the bot problem really serious, or is it just noise? His answer was direct and unambiguous: it’s a big problem, and it’s been a growing one for years. With AI now lowering the barrier to creating convincing fake personas and coordinated bot swarms, the threat landscape is evolving faster than most people realize.
He framed the landscape around three major categories of manipulation:
Fake accounts and bots — fully automated or semi-automated accounts operating at scale to post, like, and amplify content without a human in the loop
Foreign interference — state-sponsored or state-tolerated operations (Russia, China, Iran, and others) designed to sow division, suppress turnout, or gather intelligence
Domestic disinformation — originating from domestic interest groups with a specific agenda, regardless of political leaning, who use bots to amplify their preferred narratives
The image of a Russian bot farm takedown inside Kyiv, shown during the webinar, is a jarring reminder that this isn’t theoretical. Actual physical infrastructure — racks of phones and SIM cards — is built and operated for the sole purpose of impersonating real people online. The photo of the “Botoferma” takedown makes the abstract suddenly very concrete.
The Typical Manipulation Process
One of the most educational parts of the presentation was Torry’s walkthrough of how manipulation actually unfolds. Understanding the process is one of the most important things we can do as citizens and critical consumers of media.
Here’s the general pattern:
A triggering event occurs — an election, a crisis, a controversy (real or manufactured)
Bad actors identify the opportunity and craft a message tailored to exploit existing emotional tension
The message gets seeded into fringe communities first — not broadcast widely right away
Once it gains traction in those fringe groups, bots amplify it — boosting it into mainstream feeds through engagement signals (likes, shares, comments)
Social media algorithms, designed to surface popular content, move it even higher
Real users share it organically, making it indistinguishable from grassroots content
When corrections eventually arrive, the original narrative has already traveled much further and faster than any retraction ever will
That last point is the most sobering one. The whole purpose of step one through six is to get the information embedded before anyone can stop it. Corrections are almost always too little, too late.
Torry specifically called out messaging red flags to watch for — patterns that should prompt extra critical scrutiny:
Emotional exploitation — content designed to trigger fear, anger, or outrage
Tribal and identity mechanics — appeals to your in-group identity that push you toward a “us vs. them” frame
Sensational, overly confident, repetitious language
Cognitive bias exploitation — taking advantage of what you already believe
“Grain of truth” and structural/narrative tricks — wrapping false claims inside true ones to build trust and credibility
Trust erosion and attacks on credibility — undermining institutions, journalists, or fact-checkers
This list maps well onto what I teach in my middle school media literacy classes, about SIFT and using “lateral reading” as a strategy for vetting sources. When I teach media literacy, I want students to recognize that their emotional reaction to a piece of content is actually a cue to slow down, not speed up. Torry made the same point: when content is crafted to make you angry or outraged, your desire to fact-check goes down. That’s not an accident. It’s by design.
Cherry-Picking as Manipulation: The Coffee vs. Tea Example
One of my favorite moments in the webinar was Torry’s “Coffee vs. Tea” case study. He showed a polished-looking infographic from a made-up source — “Coffee Drinkers for Truth in Beverage Research, 2024” — that laid out a compelling case for why coffee is clearly healthier than tea. The data cited was technically accurate. But the graphic omitted every negative for coffee and every positive for tea. It was cherry-picking disguised as research.
This is a perfect classroom-friendly example of confirmation bias exploitation and selective framing — and it works precisely because the individual facts aren’t false. As Torry put it, “all the information that’s included actually is true… it’s how I’ve manipulated and presented this in a way that influences toward coffee being better than tea.”
The question to always ask: What’s being left out? Is there an agenda? And — importantly — who made this, and do they have a financial or political interest in my believing it?
Spotting a Fake Account: A Real-World Checklist
Torry walked through a series of actual fake profiles he had encountered in a veterans’ Facebook group he helps administer — the 9th Infantry Division Association — which his grandfather’s World War II service connected him to. This group became a target for two different types of malicious actors: commercial spam bots trying to sell t-shirts, and what appeared to be intelligence-gathering accounts.
The red flags he identified from real examples are genuinely useful as a practical checklist:
Unusual name formatting (last name, first name — often a cultural artifact of non-native account creators)
Very few photos for the age and supposed engagement level of the account
Profile claims that don’t add up geographically (school listed as being in Pakistan for someone supposedly from Idaho)
Friend lists that are heavily concentrated in one foreign country with no local connections
Likes and interests that don’t match the claimed identity
Accounts that only ever post one type of content (e.g., links to a product) with no authentic history
Cross-connected bot accounts that all “like” each other to signal-boost — what Torry called a visible bot network in the likes column
None of these is automatically disqualifying by itself. But when you start stacking red flags, a pattern emerges.
What You Can Actually Do
Torry’s tone throughout was pragmatic rather than panicked. He was clear: You and I as individuals are not going to stop bot farms. But we can do a few meaningful things:
Slow down before sharing. If a piece of content is making you feel outraged or afraid, that’s a signal to pause, not click share.
Check the source. Even a two-minute lateral reading exercise — searching the source or claim in a new tab — can surface critical context.
Look at the account posting it. Apply the red flag checklist above. Does the profile look like a real person with real history?
Verify outlandish claims before amplifying. Torry noted that “outlandish claims” are the ones most worth verifying. Most of us don’t have time to fact-check everything — but if something is seeming like a biased take or making an extreme claim, that’s the moment to invest a few minutes.
Report fake accounts. Every major platform has a reporting mechanism. It’s imperfect, but it contributes to data that helps law enforcement map bot networks. You can also report to the FBI’s IC3 platform.
Verify links in AI-generated content. Torry noted that even while building his own presentation, an AI tool hallucinated a Thomas Paine quote that didn’t exist. If an AI is giving you references, click on those links. Check if they actually exist. If they don’t, that’s a major red flag for the whole piece of content.
Why This Matters Especially for North Carolina
With a competitive U.S. Senate race anticipated in North Carolina this fall, Torry was particularly direct about the threat landscape here. Competitive statewide races attract disproportionate interference — from fake polls and fabricated margin data, to voter suppression messaging with false information about polling locations or eligibility, to coordinated accounts infiltrating high-trust local communities like neighborhood apps, school pages, and veterans’ groups.
He emphasized that high-trust, closed communities are especially appealing targets — precisely because the perception of safety is what makes members lower their guard. A message that would seem suspicious in the open internet can feel authoritative and credible when it arrives through a community you already trust.
The stakes are real. The threat is real. And the defenses are learnable.
You can find more ways to connect and learn with me, Wes Fryer, on wesfryer.com/after. This article is cross-posted from my blog, “Moving at the Speed of Creativity.”