Katie Martin / The Atlantic

Travis Hawley was scrolling through the comments sections of LeBron James’s Instagram posts recently when he noticed some postings from other athletes.

“Dm me to buy verification badge,” wrote Dmitry Orlov, a player for the Washington Capitals. “Dm me to buy verification badge! Paypal, Zelle, Cashapp,” Malcolm Grant, an American professional basketball player in Lithuania, commented repeatedly.

Other athletes joined in. The Cleveland Browns defensive tackle Sheldon Richardson, the Cincinnati Reds third baseman Jonathan India, the San Diego Padres shortstop Fernando Tatis, and the Tampa Bay Buccaneers wide receiver Bobo Wilson all claimed in the comments sections of major sports stars and celebrities that they could sell blue check marks to anyone, for the right price. Their accounts had, of course, been hacked; all have since been restored.

But while their comments were live, some people took the bait, asking what they’d need to do or how much they’d need to pay. Hawley, who worked as a government intelligence analyst before getting into social-media marketing, told me he suspected it was a scam but decided to follow the hackers down their rabbit hole, chatting with one man on WhatsApp and by telephone and, eventually, paying him several hundred dollars. When Hawley made it clear he wouldn’t be sending any more money after his initial offering, the hacker blocked him on WhatsApp and Instagram. Hawley remains unverified.

The network of Instagram verification-peddling scammers that Hawley encountered is just one of many groups of people seeking to exploit the company’s mysterious verification process for personal gain. Some hackers create fake accounts claiming to offer blue check marks only to steal users’ personal data. Others cheat influencers with fake verification services before commandeering their accounts. Hundreds of people online advertise verification services. And some users have even been able to obtain a check mark after paying thousands of dollars. But the prevalence and longevity of these verification ploys reveals more about the system than the scammers: It’s only because verification is so opaque, and so seemingly arbitrary, that they seem plausible in the first place.

Being verified comes with perks: Typically, your comments are sometimes featured higher, it’s harder to impersonate you, and you get more robust insights on your personal account. Ten years ago, Twitter first pioneered the blue check mark; the initial rollout was messy. Five years later, at the end of 2014, Instagram introduced verification badges, but initially only verified users through its partnerships team, which works with top-tier celebrities and brands like Beyoncé and Madonna.

Over the years, however, the threshold for verification on all platforms has been lowered significantly. Instagram began giving out more check marks to journalists and business figures, and Twitter introduced a public verification-request form in 2016. In 2017, the company claimed to put verification on pause, but continued to verify users at a steady rate behind the scenes. In 2018 Instagram also introduced a public verification-request form, and the number of verified users ballooned even more.

Instagram doesn’t release statistics on how many users it verifies per year, but both platforms almost never revoke badges unless a user explicitly violates terms. This means that even if you leave an industry or stop doing the thing that you became well known for, you won’t lose your badge. I recently came across the profile of a woman who worked at a small public-relations company in Texas and had just a few hundred followers on Twitter and even fewer on Instagram, yet was verified on both platforms. I discovered through LinkedIn that she had been a journalist several years ago for hardly more than a year. (I myself am verified, simply because I’m a reporter who could theoretically be impersonated, not because I am a well-known figure. But if I left my profession tomorrow, I would, under the current system, retain my check mark. )

The line between celebrities and average users has also blurred over the years, thanks to the proliferation of influencers. Reesa Lake, the executive vice president of brand partnerships at Digital Brand Architects, an influencer management company, told me that verification has become so arbitrary that it’s lost meaning within her industry.

“I think the way brands look at it has changed,” Lake said. “It’s not as essential. They look for different qualities in influencers other than if they’re verified. Verification is a personal vanity metric at the end of the day.” She points to someone like Helena Glazer Hodne, known online as Brooklyn Blonde, as a prime example of a hyper-successful influencer who consistently nabs quality brand deals without having a check mark.

All this has led to a glut of mid-tier celebrities, sports stars, and moderately known people across a wide span of industries getting blue check marks on Instagram and Twitter—while people with as many, if not more, followers don’t have them. Verification scams, like the one Hawley happened upon, are so common because users constantly encounter seemingly nonfamous people with check marks. It’s easy to assume that if this many unremarkable people have achieved verification, it must be something you can buy. “How do people get verified cuz I [swear to God] they’re just givin em out to randos so they feel better about themselves,” one person tweeted.

Some people have suggested incremental changes to the verification process. Mahzad Babayan, the director of talent at Fullscreen, an entertainment company that works with social-media stars, told me that perhaps establishing a review process is in order. “If we’re looking at oversaturation on the platform, they probably need to implement something like a review process,” she said. “It’s like having a job. Don’t you get reviews?” Niv Dror, a venture capitalist, told me that the verification team should offer customer support for those seeking it. “They should have a human you can contact,” Dror said.

But these stopgap measures still perpetuate a broken system and won’t ultimately eliminate abusers like the ones Hawley encountered. Rather than have a binary system where users are either check-marked or not—and the lucky few get access to special perks that all users would likely appreciate—Twitter, Instagram, and the like should rebuild the whole system and adopt new features to meet users’ needs. “When I ask friends how they get verified, nine times out of 10 they say they know a guy,” says Siqi Chen, the chief product officer of Sandbox VR. “It seems to be a predictable symptom of the fact that it takes knowing someone to get verified. But when Instagram and Twitter rely on personal relationships it opens the opportunity for scamming. Anyone can say ‘I know someone at Insta who can get you verified,’ and there’s no way to prove or disprove that.”

One key way check marks function is as a badge of authenticity. If you’re seeking out clothing from a specific brand, or looking to see if a profile is a specific account and not an impersonator, a verified badge comes in handy. But verified badges are a poor way to deliver this information to users. Twitter and Instagram could, for instance, simply allow any user to link their offline identity or business to their profile. Eugene Wei, a former product head at Flipboard and Hulu, told me that making such a change is key for Instagram as the company moves further into e-commerce. He likens it to when Amazon rolled out verified buyer and seller badges. “You may be like, ‘Hey, is this a legit retailer that I should trust?’” he said. “Having a different system that’s more meaningful and not using a blue check, which is really broad and meaningless, makes sense.”

Chen thinks platforms would also do well to develop a new system that clearly communicates information about how and why users are verified. “From a product standpoint, if you want to design something scalable, you need clear standards so that you can give this decision to anyone, or even a machine, to make a judgment call,” he says. “It’s the lack of clear standards that results in the state we have today.”

Until Twitter and Instagram take steps to publicly delineate what exactly verification means on the platform, and offer a transparent public process for vetting people, bad actors will exploit people’s confusion. And more people will continue to dream up theories about how the process works. “I wonder if [the confusing verification process] isn’t intentional,” Chen says. “If the hidden standard is that you’re a notable person, maybe the fact that you can reach someone at Facebook or Instagram to get verified is part of the test.”

This article is part of “The Speech Wars,” a project supported by the Charles Koch Foundation, the Reporters Committee for the Freedom of the Press, and the Fetzer Institute.

We want to hear what you think about this article. Submit a letter to the editor or write to letters@theatlantic.com.