Skip to main content
    ← Back to blog

    How to verify a business’s Instagram from its website (what dead sameAs links actually mean)

    July 29, 2026 · Scam Finder Team

    Learn how websites claim Instagram and TikTok identity with schema.org sameAs — and how to spot dead, mismatched, or fake-looking profiles before you trust them.

    When people want to know whether a website is trustworthy, they often open the company’s Instagram or TikTok. That instinct is reasonable — a living social presence can feel more “real” than a polished landing page. It is also incomplete.

    In 2025, nearly 30% of people who reported losing money to a scam told the Federal Trade Commission that the scam started on social media. Reported losses reached about $2.1 billion — roughly eight times the 2020 figure, according to the FTC’s data spotlight. The FTC’s own consumer advice still includes a basic step: before you buy, search the company name plus “scam” or “complaint”. Checking social profiles sits next to that advice in most people’s heads. The problem is that the profile you check may be fake, hijacked, inactive, or simply unrelated to the website that linked you there.

    This guide is about a narrower — and more useful — question: does the social account a website claims as its own actually match that business? The answer often hides in a machine-readable field called sameAs, and in whether anyone ever resolves those URLs against live profiles.

    Why follower counts alone fail

    Social metrics look like proof. They are easy to manufacture.

    In 2018, The New York Times published “The Follower Factory,” an investigation into Devumi — a company that sold fake Twitter followers and other engagement at industrial scale. Drawing on an estimated stock of millions of automated accounts, Devumi had provided customers with more than 200 million Twitter followers, according to that reporting. The FTC later brought what it described as its first complaint challenging the sale of fake indicators of social media influence, alleging Devumi filled more than 58,000 orders for fake Twitter followers (among other products) and settling charges against the company and its CEO (FTC press release).

    The policy landscape has continued to harden. In August 2024, the FTC finalized its Trade Regulation Rule on the Use of Consumer Reviews and Testimonials. Among other prohibitions, 16 CFR § 465.8 makes it an unfair or deceptive practice to sell or buy fake indicators of social media influence — followers, views, and similar metrics generated by bots or hijacked accounts — when the buyer knew or should have known they were fake and used them to misrepresent influence for a commercial purpose (FTC final rule announcement).

    So a large follower count is not a trust certificate. What you want is identity match: does this Instagram (or TikTok, LinkedIn, YouTube) page belong to the same organization as the website you are evaluating?

    The overlooked signal: schema.org sameAs

    Many websites already declare their official social profiles in structured data. Schema.org defines sameAs as the URL of a reference web page that unambiguously indicates the item’s identity — for example a Wikipedia page, Wikidata entry, or official website. Brands commonly put Instagram, TikTok, LinkedIn, and X URLs in an Organization JSON-LD block:

    {
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Example Store",
  "url": "https://www.example-store.com",
  "sameAs": [
    "https://www.instagram.com/examplestore",
    "https://www.tiktok.com/@examplestore",
    "https://www.linkedin.com/company/example-store"
  ]
}

    Search engines use Organization markup — including identity links — to understand entities. Google’s Organization structured data documentation describes how to mark up an organization so Google can understand corporate details; sameAs-style identity linking is part of how brands connect a site to official profiles elsewhere.

    Here is the catch scrapers and humans both miss: listing a URL is not the same as verifying it. A footer icon and a sameAs entry are claims. Until you open the profile — or programmatically resolve it — you do not know whether:

    • the account still exists,
    • the display name matches the business,
    • the bio links back to the claimed domain,
    • the account is active, empty, or clearly someone else’s brand.

    At Scam Finder we already encounter this gap in website metadata pipelines: structured data often includes social URLs, but resolving those URLs into live profile facts is a separate step. Treat sameAs as a pointer, not proof.

    How to find sameAs yourself

    You do not need special tools for a one-off check:

    1. Open the website and scroll to the footer for social icons.
    2. View page source (or use browser DevTools → Elements) and search for sameAs or application/ld+json.
    3. Optionally paste the URL into Google’s Rich Results Test to see whether Organization markup is parsed.

    If the site has icon links but no JSON-LD, use the visible links — the verification steps below still apply.

    A 7-step checklist to verify a business’s Instagram (and other profiles)

    Use this whenever a website asks for money, personal data, or trust.

    1. Collect the claimed profiles
      Note every Instagram, TikTok, Facebook, LinkedIn, YouTube, and X link from the footer, About page, and JSON-LD sameAs array. Write down the exact handles.

    2. Confirm the profile loads
      Open each URL in a private window. A 404, “user not found,” suspended account, or login wall with no public content is already a red flag. A dead sameAs link is often worse than no link — it suggests an identity that used to resolve and no longer does.

    3. Check brand consistency
      Compare the website’s name, logo, and color palette with the profile’s display name and avatar. Minor differences happen; a clothing brand bio on a “crypto trading academy” site does not.

    4. Look for a domain loop
      Does the bio, website field, or Linktree point back to the same domain you started on (or a clearly related official domain)? Scammers often clone a storefront and point social icons at unrelated or abandoned accounts. A bio that links nowhere — or to a different company — weakens the identity claim.

    5. Check activity against the pitch
      If the homepage says “trusted by thousands since 2024” but Instagram has three posts from 2019 and silence since, treat the marketing copy as unverified. Inactivity alone is not proof of fraud; combined with aggressive claims, it is a caution signal.

    6. Treat vanity metrics as weak signals only
      Extreme follower/following ratios, sudden spikes, or engagement that does not match content quality can be suspicious — but bots and purchased metrics exist precisely to confuse this check. Prefer identity and activity over raw counts.

    7. Cross-check platforms
      If Instagram, TikTok, and LinkedIn all claim different company names, different websites, or wildly different ages of presence, ask why. Legitimate brands are usually consistent across the profiles they advertise.

    What mismatch patterns look like (composite examples)

    The following are composites — patterns assembled from common red flags, not reports about a specific real company.

    Composite A — “growth shop” with a borrowed identity.
    A site selling “real TikTok followers, instant delivery” includes Instagram in sameAs. The Instagram handle loads, but the bio describes a vintage clothing reseller, the highlight covers are outfit dumps from years ago, and there is no link to the follower shop. The website claimed a social brand it does not control.

    Composite B — polished storefront, hollow profiles.
    An “AI investment mentor” funnel site links Instagram and YouTube. Instagram exists with a stock-photo avatar and 40,000 followers, but only two grid posts and comments that look duplicated. YouTube shows three videos with view counts that do not match subscriber growth. The social layer is decoration for ads, not an established business presence.

    Composite C — renamed domain, leftover social.
    A checkout domain registered last month still has footer icons pointing at an Instagram that mentions a different shop name and an old .shop URL. Someone reused a template — including social links — without updating identity.

    None of these patterns alone prove a scam. Together with payment pressure, too-good-to-be-true pricing, and no independent reviews, they justify walking away.

    How a review platform would automate this

    Manual checks scale poorly when you evaluate thousands of domains. A review site can turn the checklist into a pipeline:

    1. Scrape the business homepage (and key landing pages).
    2. Parse Organization JSON-LD and visible social anchors to collect sameAs URLs.
    3. Extract platform + handle from each URL.
    4. Perform a live profile lookup for public fields (display name, bio, follower counts, recent activity signals when available).
    5. Store enrichment next to other website metadata.
    6. Surface caution on the public business page when links are dead, mismatched, or inactive relative to marketing claims.

    The important design detail: check whether the lookup found a profile before you store or display anything. Pseudocode for that guard:

    type ProfileLookup = {
  lookupStatus: "found" | "not_found";
  handle?: string;
  displayName?: string;
  bio?: string;
  followers?: number;
};

async function enrichSocial(sameAsUrls: string[]) {
  const results = [];

  for (const url of sameAsUrls) {
    const handle = extractInstagramHandle(url);
    if (!handle) continue;

    const profile: ProfileLookup = await fetchPublicProfile(handle);

    if (profile.lookupStatus !== "found") {
      results.push({ url, status: "dead_or_missing" });
      continue;
    }

    results.push({
      url,
      status: "resolved",
      handle: profile.handle,
      displayName: profile.displayName,
      bio: profile.bio,
      followers: profile.followers,
    });
  }

  return results;
}

    Your product owns the heuristics — name similarity, bio→domain matching, “inactive since” rules. The data layer only needs reliable public profile payloads. In practice, that live step is where teams reach for an API instead of maintaining brittle platform scrapers. For Instagram and TikTok profile resolution, Social Fetch is one option that returns structured public profile data with an explicit lookup outcome you can branch on. The same automation works with any provider that offers live Instagram and TikTok profile lookups — what matters is fetching fresh public fields and refusing to treat a missing account as a successful enrichment.

    Scam Finder’s long-term direction for business pages is exactly this kind of enrichment: website scrape first, social identity resolution second, human-readable caution when claims do not line up. Until that ships end-to-end, the checklist above is what we recommend you run by hand.

    Limitations and ethics

    • Public data only. Private accounts, region blocks, and platform outages produce gaps. Absence of evidence is not always evidence of absence.
    • False positives happen. New businesses may have thin social histories. International brands may use different domains per region. Always combine signals.
    • Metrics are not verdicts. Even “resolved and matching” profiles can still run fraudulent offers. Social verification is one layer next to reviews, payment practices, and independent complaints.
    • Not legal advice. If you lose money or spot fraud, report it to the FTC at ReportFraud.ftc.gov and follow local guidance.
    • API callers stay responsible. Third-party profile APIs return publicly available information; how you store, display, and score it remains your obligation under your policies and applicable law.

    Practical takeaway

    For consumers:

    1. Do not stop at “they have Instagram.”
    2. Confirm the profile is live, branded consistently, and loops back to the domain.
    3. Treat dead or mismatched sameAs links as a serious caution light.
    4. Still search the company name with “scam” or “complaint,” as the FTC suggests.

    For builders:

    1. Stop treating sameAs as decorative SEO markup.
    2. Resolve claimed social URLs into live profile state before you trust them in product UI.
    3. Gate every write on an explicit found / not-found outcome.

    Social links are easy to paste into a footer. Identity is harder to fake consistently across a website, a bio, and an active account. That gap — claimed identity versus live profile state — is one of the most practical trust checks available before you send money, share data, or leave a five-star review.

    Sources