The Human Data Illusion: How to Tell Real People From Data That Only Looks Human

When does data stop proving there’s a person behind it?

What happens when data looks human enough that we stop questioning whether there’s actually a human behind it?

For years, a record with a sensible name, a valid email address and a real postcode was treated as a person. Most systems still work that way: if every field passes format and plausibility checks, the record is accepted. But producing plausible data is now cheap and easy, which means plausibility on its own has stopped being evidence.

Where do human-looking fake records come from?

• Bots and scripts that fill in forms with realistic details, often drawn from lists of real names and addresses.
• Synthetic identities stitched together from real and invented details, designed to pass identity checks.
• Stolen data from breaches, which is real by definition and so looks entirely human.
• Generated profiles that use realistic names, photos and text to build accounts at scale.

Each of these is built to pass checks that ask “does this look valid?” and almost all of them do.

What does episode 002 cover?

Episode 002, “The Human Data Illusion”, asks what happens when data looks human enough that we stop asking whether there’s actually a human behind it. It is a question that runs through every later episode, from KYC to lead generation to affiliate fraud.

Listen to the episode for the full conversation.

Why do standard checks miss it?

Most validation tests each field on its own. Is the email formatted correctly and deliverable? Is the postcode real? Is the phone number the right length? A generated or stolen record passes each test, because each field, taken alone, is fine.

What generated records struggle with is depth and consistency. Real people accumulate history slowly: a phone number kept for years, an email address used across many services, a home location that matches where they browse from. Fabricated records tend to be shallow, new or inconsistent once you look across fields instead of within them.

How do you check for a real person?

1. Check phone tenure and status. A live number that has been in use for years is strong evidence of a real person. A brand-new or unreachable number is weak.
2. Check email history. A long-established address with a footprint is very different from one created minutes before sign-up, or from a disposable domain.
3. Compare location signals. Does the IP address fit the stated address? Is the connection coming from a data centre, VPN or proxy?
4. Watch behaviour. Form fills completed in impossibly short times, identical timings across many sign-ups, or bursts of activity at odd hours point to automation.
5. Look for links between records. Many accounts sharing a device, phone, email pattern or IP range usually means one operator, not many people.
6. Score the whole record. Combine these signals into a single view. A real person usually has several strong signals that agree. A fake record usually has one or two good-looking fields and little behind them.

What is the bigger lesson?

The lesson of the human data illusion is to stop asking whether data looks right and start asking whether it holds together. That shift, from checking fields to checking evidence, is the thread that runs through the whole series.

See how to tell real people from human-looking data, with an example of the signals that expose a fake sign-up.