How to track down the original owners of stolen Twitter accounts

Recently, one of the accounts I follow on Twitter was hijacked. It was turned into a PS5 giveaway scam. The people who hijacked the account changed the name, avatar, and deleted all the previous Tweets. Here's how I found who the original owner was, and managed to contact them.

A Twitter account has a screen name. Mine is @edent. It is possible to change your screen name. Each Twitter account has a unique user ID. This is a numerical code that the API uses to keep track of users. Mine is 14054507. The user ID never changes - even if you change your screen name.

If you have an API key, you can use the V2 API to look up a user's ID from their screen name

twurl "/2/users/by?usernames=Ps5retaildealer" | jq

Results in:

 JSON{

  "data": [

    {

      "id": "18982572",

      "name": "Ps5 Seller",

      "username": "Ps5retaildealer"

    }

  ]

}

If you don't have access to the API, you can use https://tweeterid.com/ to get the same information.

The next step is to find the original screen name. I did this by searching for replies to the user ID.

Because the hijacked account's user name has been changed and all its previous Tweets deleted, it isn't possible to use the regular site search, so it is back to the API

twurl "/2/users/18982572/mentions" | jq

In amongst all the replies to the scammer's new Tweets, was this:

 JSON    {

      "id": "1338782887710232576",

      "text": "London, St George the Martyr, Holborn, on the corner of Queen Square. The benefaction Board recording Christmas Dinners for Chimney Sweeps is the chief item of interest. @NatChurchTrust @badger_beard @roberrttoa @stepneyrobarts @TomsBritain @BeardyHowse https://t.co/xbdlepkvcG"

    }

Looking at the original Tweet, I could see one of the users appears to have been deleted.

I confirmed this by searching for the deleted user name:

https://twitter.com/search?q=TomsBritain

There was a Tweet from another user, mentioning Tom, but showing as in reply to the scammer.

From there it was pretty easy to find Tom's website. I used the WayBack Machine to look at an archived version of the account. I sent the owner a message to let him know about the account.

So, there you go, a relatively simple way to trace back the ownership of an account.