Twitter Blue not actually “verifying” IDs, despite Elon Musk fix

The problem is, @SenatorEdMarkey is actually me, not the real Sen. Edward J. Markey. It’s a test of Twitter’s $7.99 per month Blue “verification” service I made with the permission of the real Democrat from Massachusetts. I wouldn’t blame anyone for being confused: My test account has the senator’s name and photo and a blue check mark that says it is “verified.”

But Twitter, it seems, isn’t verifying much of anything.

This is the second time I’ve been able to impersonate the senator. Back in November, when Twitter first began selling its iconic blue check marks to anyone for a fee, I showed how easy it was to buy official-looking status with an impostor account called @realEdMarkey. Musk, who bought Twitter in October, got into a Twitter fight with Markey about it. Then Musk shut down Blue and promised that in a new-and-improved version “all verified accounts will be manually authenticated” before they’re given the authority of a check mark.

After Blue 2.0 (my term for it) launched on Dec. 12, I made another faux Markey and applied for verification. Some of Twitter’s new requirements slowed down the process — and might dissuade some impatient impersonators — but the company never asked to see a form of identification. Last week, up popped a blue check mark on my @SenatorEdMarkey account. Oops! I did it again.

Twitter didn’t reply to a request for comment. After I published this story, Twitter suspended the @SenatorEdMarkey account.

Two months into Musk’s takeover, millions of Twitter users face a real question: Is Twitter getting better or worse? Is it even worth putting our time into Twitter anymore, or should we abandon ship for something else, be it Mastodon, Instagram or TikTok?

Twitter has yet to devolve back into the impersonation circus we saw when Blue first launched. But my test shows Twitter does not understand the dangers of misinformation or the value of authenticated sources. Under Musk’s leadership, Twitter users face a greater risk of seeing something fake and thinking it is real. I don’t know if Twitter is going to die any time soon, but I’m spending less time on a service I can’t trust.

How I bypassed verification again

Creating my impostor senator the first time around was dead simple. All I needed was a new Twitter account running on an iPhone and a credit card to pay for Blue.

For Blue 2.0, Twitter added two additional hurdles that could help slow people and bots from making fakes. To test it, I needed a Twitter account that was at least 90 days old — new accounts are not eligible. A colleague had one he hadn’t used in years, so he dedicated it to the cause. After we changed the name of the account to @SenatorEdMarkey, Twitter made us wait 7 days before we could sign up for Blue.

Second, I also had to link the account to a phone number before I could sign up for Blue. To do that, I visited the T-Mobile store at the mall, and got a 1-month temporary number for $15 — no name or ID required.

Once I had all of those pieces in place, I signed up for Twitter Blue on the web, paying with a credit card. At that point, I expected Twitter would ask me to prove my identity, such as uploading a snapshot of a drivers’ license. I thought Twitter might be suspicious that the account was owned by a random Gmail address, not one ending in senate.gov. I assumed its verification system might challenge me after scanning for the word “senator” or maybe even the names of the notable people with legacy verification status.

But no. After 7 days, a blue check mark appeared on the faux Markey account, no questions asked.

As far as I can tell, Twitter has never said what goes into “manually authenticating” an account. Since Musk bought Twitter, the company also now has a greatly reduced workforce — so it’s not clear who’d be around to do the checking.

Twitter says impersonating others is not allowed, and accounts that do so face suspension when they’re discovered. But in 2023, it’s not enough to just make a rule. Twitter has to do something to actively stop it from happening — and its Blue adaptations clearly aren’t enough. Across the internet, authentication is becoming increasingly common. Airbnb asks you snap a photo of your ID to rent a room; Facebook asks for an ID to gain access to hacked accounts.

Musk often tries to frame criticisms as culture wars — but evaluating how well a product’s core functions work isn’t a partisan act. It’s a tech review, and I do it with the same critical eye to new Apple iPhones, Amazon shopping results and Twitter check marks. I take the side of users, and last week published a column agreeing with Musk about the need to stop a form of online censorship called “shadowbanning.”

Musk appears to have several goals in selling Blue subscriptions. First, he needs a new source of revenue after taking on billions in debt to buy Twitter. Second, he wants a mechanism to separate real users from bots, whose creators are less likely to pay for a subscription. Finally, he has said that offering verified status to more users will level the playing field, encouraging more people with wider views to be active on Twitter.

It’s possible that people who buy blue check marks will tweet more. But without actually doing the hard work to authenticate them, Twitter is eroding one thing that helped make it into a cultural juggernaut: You could trust it. Its legacy verification system — in which the company really did check who owned an account — was opaque, but it meant when an elected official, company or celebrity tweeted, you’d believe it was them.

The real Markey, who has long been a critic of Big Tech, told me Twitter had failed a basic test. “It’s an absolute joke that Elon Musk, who prides himself on being a tech entrepreneur, can’t implement a functioning verification regime — except users aren’t laughing,” Markey said.

“Twitter’s current leadership has failed to safeguard the platform from misinformation, failed to provide answers to my simple questions regarding their anti-fraud protocols, and failed to demonstrate an appreciation for the role that their platform plays in our democracy,” he said.

In a partial return to Twitter’s old system, Twitter has said it plans to offer different-colored verification marks for officials and corporations separate from its Blue services. That isn’t going to help independent creators, but Twitter did give The Washington Post’s account a gold check mark for businesses, and President Biden’s account a gray one.

And so far, Twitter has not given any special marks to the accounts belonging to U.S. senators such as Markey.

As of press time, Markey’s real account still has a blue check mark that says, “This is a legacy verified account. It may or may not be notable.” My fake one, meanwhile, says “This account is verified because it’s subscribed to Twitter Blue.”

There is a difference and it matters to Twitter’s users — and its future.