It was around 1am when I discovered my impostor was watching me. I was sitting up in bed, scrolling on my phone through the list of people who had viewed my Instagram story. The audience was the same as it always was: friends, family and a smattering of followers I had picked up over the years. But a tug from my subconscious told me, this time, something was wrong. I scrolled back up and there it was: an account I had never seen before. Their profile photo was a selfie I had taken in a bookshop basement years ago.

Have you ever walked by an unexpected mirror and jumped at your own reflection? That’s how it felt as I stared back at myself, unnerved by my sudden appearance.

I brought the screen close to my face. The photo was old, from 2016, but it was a day I remembered well. I had just handed in my university dissertation and I was enjoying my newfound freedom. I had been ambling through Cardiff and had taken a snapshot in a mirror to mark the moment. My gold iPhone 5 looked tiny in my hand and I was wearing my favourite flannel shirt. These were familiar fragments of my life back then. Now, someone had seemingly come along and picked them up out of the bin.

Was it just a glitch? A strange Meta mess-up that would reset if I clicked on their account? I would feel silly but relieved, then settle into bed with the world returned to how it was. But when I visited their page the image remained. According to Instagram, it now belonged to someone named Paweł Sibilski.

Paweł had 691 followers and he was following more than 2,600 people. I couldn’t see who they were, or the four posts he had shared, because his profile was private. In his bio, written in Polish, he described himself as a developer and investor. There was a Facebook link beneath it. I tapped it with a curiosity that swelled into horror.

Paweł’s Facebook was like a shrine devoted to my face. His profile photo was a selfie I had taken outside a pub in 2018. His cover photo, directly above it, was a shot of me wearing a hoodie on a frosty day in 2016. There was another photo where I was mid-expression, my hair blown sideways; I couldn’t even remember when that was taken. It was like watching footage of myself sleepwalking; there I was, all over his account, with no memory of how I got there.

Panic set in. The account was mostly private, but I pieced together what I could. Every photo (besides a stock image of an empty bar) was a different closeup of me. Paweł had been uploading them since 2020, but they spanned almost a decade of my life. Hundreds of people had liked and commented on them, and Paweł had humbly thanked them. He was incredibly popular, with 4,600 Facebook friends (about six times more than I have on my own account) – and he had spent the last four years convincing them that he was really me.

I thought of the hapless hero in Dostoevsky’s novel The Double, when Golyadkin encounters his beguiling doppelganger. The duplicate charms his way into Golyadkin’s life, wins over his colleagues and friends, and eventually replaces him. Golyadkin later loses grip of his identity and has a severe mental breakdown. I know this story because it was the subject of my dissertation, the same one I had handed in before taking that bookshop selfie. Did my impostor somehow know this? Had he read the book as well? What else were we sharing that I had once thought belonged only to me?

Paweł’s Facebook account had a longer bio, again written in Polish. I used Google to translate the top line. “Bądź Zawsze Sobą,” it read. “Always be yourself.” I couldn’t decide if it was comical or violating. I was concerned, but also weirdly flattered. I couldn’t help feeling slightly buoyed up by the fact that I had been selected; that my photos were considered worth stealing. But who was Paweł, why had he chosen me and what had he done with my identity?

* * *

My impostor was more protective of my personal details than I had been in my online life. In order to see what else he had hijacked, I had to become his Facebook friend. A fresh wave of paranoia made me wonder if we were already connected. I rushed back to my private account and scanned my friends list. How well did I really know these people?

In recent months I had tightened my social media security, but in the past I had recklessly accepted all requests. I’d had the same Facebook account for over 15 years, and Paweł had clearly been watching me for about half a decade. I tried to view my profile as one of my current 800 “friends” would see it. They would know the names of my family and pets, where I studied, where I worked, where my parents were buried, what my childhood looked like, where I lived, the places I had been and the places I was likely to visit again. It was a fraudster’s cheat sheet, a stalker’s dream.

Paweł was accepting compliments about my face beneath my reproduced photos and passing them off as his own. He was clearly a crafty catfish, an online con artist who takes someone else’s images and pretends to be them to deceive others. I decided to give him the same treatment; I would make a fake account and try to catfish my own impostor.

Creating an alias was harder than I expected. I didn’t want to use a name that might belong to a real person, but the pseudonyms I came up with sounded ridiculous, like badly written 1950s detectives: would you accept a friend request from Eric Pistachio or Dirk Avalanche? I ended up using my middle name followed by the first syllable of my mother’s maiden name.

I typed “cartoon character” into Google and used a popular result as my profile photo: an image of the anime ninja Naruto. For a cover photo I went with a generic woodland. It was as easy as that: a fake name and a fake face, made real by the internet. Facebook suggested some strangers I should add, so I sent them all requests to make me look more legitimate. I was surprised when dozens immediately accepted. How easily they had just let a catfish into their lives. I clicked on some of their profiles: family photos, career updates and tagged locations – I had access to the lot.

I sent Paweł a friend request. It felt sticky and horrible, as if I was betraying myself and playing into his game. Here I was, dressed as a cartoon character while I asked a stranger for permission to look at myself. Everything was out of sync. I closed my laptop, laid down in bed and tried not to think about Golyadkin.

The next morning I had 89 new friends, but Paweł wasn’t among them. He had either rejected or ignored my request. Had he somehow seen right through it? In a normal state I would have waited but I was too agitated for patience. I started drafting a message under my pseudonym. It was confrontational, so I dialled it back. I wanted answers, not to scare him off.

I told him my name was Andrew, and that I knew he was using my photos, but I said I was more curious than annoyed and simply had some questions. I took a breath and clicked send. “This account can’t receive your message because they don’t allow new message requests from everyone.”

I had stooped to the level of a catfish for nothing. In frustration I copied and pasted my message beneath one of his (my) photos. I took screenshots of his accounts and posted them to my Instagram story, to warn my friends and family. Then I took a selfie and pointed accusingly at the camera. My finger loomed large, close to the lens; on the tip I wrote, “Get your own face, Paweł.”

My followers reacted just like I had, with a mix of shock and laughter. It was surreal but funny, wasn’t it? A troubling sort of compliment. I had so many messages that I almost missed one. It was sent in such a frantic state it was missing proper punctuation.

“Hey do we know each other? Where do you know me from?” it read.

It was Paweł.

The fake innocence riled me up, along with the subtle accusation that I was somehow bothering him. He had a new profile photo now, a stock image of a silhouetted concert crowd. I told him who I was and that I wanted answers. He read this straight away and then the chat went dead for 12 minutes.

“I think it’s only fair, don’t you?” I followed up. “You have been using my photos for many years without my knowledge and befriending lots of people posing as me. All I’m asking for is an explanation.”

He started to type. He typed for a long time. The three dots promised some sort of closure, but his response when it came was disjointed and confusing – eight lines long without any full stops. Paweł later revealed he was translating everything I’d said into his native Polish, and I sensed he was also panicking. So I slowed down and asked him very basic questions.

“Would you be happy to share your real name, or your age or general location?”

“I’m a bit ashamed,” he replied, and seemed to mean it. He typed like an embarrassed child who had been caught stealing sweets.

“How old are you?” I tried again. “I’m assuming you’re a man?”

“Yes, that’s right, I’m a man. I gave my age as 25 – I’m generally a bit older.”

“How much older than 25?” He was being coy, but I felt as if I was getting somewhere.

The chat went silent again for a few minutes.

“I live in Warsaw. I’m 42 years old, I have a wife, two children and, as you can see, a double personality.”

I reeled back. I had assumed he was a young loner, not a family man. I imagined him now, messaging me while his kids played nearby. It creeped me out again. I tried to keep my questions straightforward and calm, so I didn’t scare him into silence, and slowly he began to reveal what he had done with my identity.

Paweł said he initially created the account because he wanted to make money. He had some sort of scheme I didn’t understand, but it involved selling products. He needed a photo of someone “handsome” to lure customers in. He had found me by chance as a Google result because of an old article I had written; then he had tracked down my social media. He had used my face because he thought no one would recognise it.

“Pretty boy not very popular,” he wrote. “You are not a celebrity, you are not famous.” I was now being negged by my impostor.

Paweł failed to make money from the account, but somewhere along the line he started to enjoy logging in as me. “I could be free. I wasn’t afraid of anyone,” he wrote. I almost felt sorry for him as he explained how he would come home from a tough, physical job, start drinking alcohol and slip into his online identity.

“Then I opened up – I was you,” he wrote. “I could feel like someone else for a moment and express my opinion without fear of persecution.”

This made me incredibly nervous. “What sort of opinions did you express using my profile photo?”

“Generally you got nice opinions,” he said, as if he was unable to separate the two of us in his mind. The exception, he said, would be in talking to “someone, mainly a woman, who overdid it with plastic surgery. Then I wrote honestly that she was ruining her appearance, and because you are so handsome, they wondered if they were doing the right thing.”

I felt a pang of helpless shock. Paweł was dressing up as me and haranguing women. I had viewed him as a low-risk fantasist, but he clearly had a cruel streak.

Over the following days we continued to message, and Paweł’s revelations became more sinister.

“Most girls wanted to have sex with you,” he wrote. “I also got some nude photos and videos, it was so nice.” He said he had used the account to start simultaneous romantic relationships with women who all thought they were talking to me. These lasted for up to six months at a time and ended only because Paweł refused to meet them in person. He said he still had their videos saved in a personal archive.

“Did you feel bad that the people sending you nude images thought they were sending them to someone else?” I asked in disbelief, trying not to let my anger show.

“Honestly I didn’t think about it, I was amused by the fact that they were so naive,” he wrote. “Maybe something is wrong with my psyche?”

I had thought I was the main casualty of Paweł’s deception, but now it was clear that the real victims were the women he had tricked. I felt sickened that he had involved me in this. I asked if his wife knew. He said she almost caught him on the fake account once, but he convinced her it belonged to a friend. She had no idea about his second life and the string of women he had manipulated.

“I feel guilty,” Paweł wrote. “It’s good you caught me because I wanted to end it for a long time, thank you.”

“Were you worried about being found out?” I asked.

“I have done nothing wrong to anyone. On the contrary, [as] you see for yourself, so many years and no one has reported me or anything,” he wrote, having recovered from his short-lived shame. “Can I still have your account for a while as you?”

He claimed he was using the catfish account for “good” and acting as a “psychologist” for the people he had tricked, because he talked them through their problems. This just made them sound all the more vulnerable, and his actions all the more despicable.

“I would like you to tell anyone you are still speaking to that you are not really me, and to close the account,” I wrote back.

“OK, I will do that,” he replied finally.

* * *

Paweł later told me he had deleted the profile, but I could see it was still intact. He had simply removed my images, leaving empty templates ready to be filled again. At one point Paweł unashamedly liked all of my recent Instagram photos. Part of me feared he had saved them for future use, then I remembered something he had said about AI being so convincing these days that you could use that to make a fake account instead. This was hardly reassuring.

I asked Paweł if he would put me in touch with the women he had tricked. I didn’t know what I would say to them even if he agreed; I suppose I just wanted to check they were OK. He ignored this request, then eventually said he didn’t want them to know the truth. Without his help it was impossible to track them down; his friends and followers lists were still private. Even if I somehow gained access, he had amassed thousands of connections; I had no idea which of them, or how many, he had manipulated.

I tried to shut Paweł’s account down by reporting it to Meta. I received an automatic response in seconds that said his profile didn’t go against their community standards so they wouldn’t remove it. I emailed Facebook support and tried Meta’s press office, asking about their stance on catfishing and what it would take to remove a fake account, but I received no response.

I emailed the Metropolitan police, who advised me to report what had happened, but they told me they weren’t sure where it would sit as a criminal case because the impostor seemingly lived in Poland. It felt as if there was nothing I could do to stop him. I asked Paweł if he had a final comment about his actions.

“That’s how it is in life – we don’t always do everything as it should be, it’s important to admit the mistake and change for the better,” he wrote. “I’m busy with work now and I got bored of pretending to be someone else.”

Who knows if this, or anything he told me, was true. His Facebook account is still online. For years Paweł secretly followed me; now our roles have been reversed. I find myself occasionally searching his name and keeping tabs on his page, making sure those images are still empty and not filled in with updated photos of my face, or that of someone else completely oblivious to his deception.