‘Sweet Bobby’, sour consequences: Catching catfishers in court

Social media has transformed the way that we communicate, however it has opened new avenues for deception. Take, for example, the world of online dating. Catfishing is where an individual creates a false online identity to deceive someone into having a romantic relationship with them. According to a 2023 survey, a staggering 22% of UK adults had experienced catfishing. At its worst, victims can suffer profound emotional distress, betrayal and humiliation, as their trust is manipulated and their personal information exploited.

This was the case for Kirat Assi, who was deceived into a fake romantic relationship with a man named “Bobby” in an elaborate 9 year-long catfishing scheme of “epic proportions” – a story told in the recent hit podcast and Netflix documentary Sweet Bobby. Bobby was a real person whose identity had been stolen by the scammer, eventually exposed as being Ms Assi’s cousin, Simran Bhogal. Ms Assi rightfully wanted to hold her catfisher accountable, but was initially told that a crime had not taken place. She therefore brought a civil claim. The case settled and she received an undisclosed compensation payment and a private apology via a court order dated 14 June 2021. Her case is considered the first successful civil claim in the UK relating to catfishing.

This blog explores (1) how civil claims for misuse of private information and data protection breaches can be brought by a victim of catfishing to hold a perpetrator accountable and protect their reputation; and (2) how catfishing is treated within criminal law, and the potential offences that may be committed by a ‘catfish’. 

1. Civil action

Misuse of Private Information (MPI)

MPI is a cause of action that protects individuals’ right to control information about their private life. Most reported cases are in the media context, where the ‘misuse’ of private information is the wrongful or threatened publication of personal information to the wider world (e.g. the defendant is a media organisation). However, a claim does not require ‘publication’. In the 2011 case concerning the footballer Ryan Giggs, Mr Justice Eady said “the modern law of privacy is not concerned solely with ‘secrets’ but with intrusion”. This approach can be applied to a catfishing scenario, where misuse is an intrusion of the victim’s privacy, as the catfish deceives the victim into handing over private information.

To successfully bring a claim for misuse of private information, a two-stage test must be met:

• Stage 1: Is the information private?

The claimant must first establish that they have a reasonable expectation of privacy in the information in question. Information that is not generally known and is not shared with the public, such as private messages, personal photographs, medical information, information of a sexual nature, is likely to be protected. The test is broad and “takes into account all circumstances of the case”, including the attributes of the claimant, nature of the activity, nature and purpose of the intrusion, absence of consent, and the effect on the claimant. For example, Ms Assi divulged details of her emotional vulnerabilities, relationship history, photographs and messages of an ‘intimate’ nature all of which are likely to pass this test.

• Stage 2: Balancing exercise

Once it is established that the information is private, the next stage is to conduct a balancing exercise of the competing rights: does the defendant’s freedom of expression i.e. right to use the information outweigh the claimant’s right to privacy. In a catfishing scam, given that the perpetrator has obtained the information through false pretences and has malicious intent, it is highly unlikely that the court will find that the perpetrator’s rights to freedom of expression would outweigh the victim’s rights.

• What remedies are available?

Remedies in misuse of private information include:

• Injunction to restrain the misuse – In traditional misuse of private information cases, this would be preventing publication. In a catfishing context, an injunction could prevent the perpetrator from using or sharing any private information they obtained from the victim.
• Compensatory damages – Claimants can be entitled to damages for the loss of control of their private information as well as distress. 
• Delivery up or destruction of the offending material – e.g.  requiring the perpetrator to delete/take down false profiles or online content created as part of the deception.

Catfishing victims may also hold the perpetrator accountable through a formal apology.  Ms Assi successfully obtained a court ordered written apology as part of her settlement, but this came with significant restrictions - the perpetrator insisted it remain private and limited its disclosure to a pre-approved list of individuals. Despite the apology, the perpetrator continues to refute the “numerous unfounded and damning accusations” as told in a statement for the Netflix documentary.

Breach of data protection (GDPR)
 

There can be two categories of victims in a catfishing scam: those whose identity has been misappropriated (e.g. photo / identity stolen to carry out the scam) (e.g. the real ‘Bobby’) and those who have been ‘catfished’ (i.e. fell victim to the scam.) Both can pursue a claim for breach of data protection laws under the General Data Protection Regulation (GDPR). They need to show that their personal data, as defined in Article 4, has been unlawfully processed, in violation of the GDPR principles in Article 5, breaching the permitted processing uses set out in Article 6. A victim can report a breach to the ICO who can investigate and impose penalties on the perpetrator. Whilst a claimant cannot obtain financial compensation from the ICO, they can seek this under article 82 of GDPR for material damages (e.g. financial loss) and crucially non-material damages (e.g. distress as established in Google v. Vidal-Hall (2015) .

2. Criminal action
 

Whilst the above civil remedies, such as financial compensation or injunctions, can provide some relief for victims of catfishing, they may not fully satisfy the need for a sense of justice. In Sweet Bobby, Ms Assi was told by the police that she was not a victim of a crime. Although catfishing itself is not a criminal offence, the conduct involved may fall within other criminal offences, or be used to perpetrate another offence.

• Fraud (section 2, Fraud Act 2006) – Dishonestly making a false representation intending to make a gain for themselves, or cause loss to another. ‘Romance scams’, where the catfish induces the victim to send money, gifts or other valuables to them under the pretence of a relationship, or using a false identity, may fall under this offence.
• Coercive and controlling behaviour (section 76, Serious Crime Act 2015) – Where the catfish is ‘personally connected’ to their victim and they engage in behaviour towards the victim which is controlling or coercive. ‘Personally connected’ can include people in an ‘intimate personal relationship’. This concept is not defined in statute. While the threshold is high, given Ms Assi and Ms Bhogal (pretending to be ‘Bobby’) were engaged, one could argue the threshold is met. Ms Bhogal’s behaviour, in the context of this ‘relationship’ may be deemed to have been controlling and coercing – for example, in pressuring Ms Assi to give up her job and making Ms Assi account for her activity and whereabouts (including when she used the bathroom) at all times, causing Ms Assi significant distress.
• Causing a person to engage in sexual activity without consent (section 4, Sexual Offences Act 2003) – Sending intimate images online, by webcam or phone, or engaging in conversations of a sexual nature all encompass ‘sexual activity’ under this offence (Grout [2011] EWCA Crim 299). There is a conclusive presumption in section 76 of the Sexual Offences Act 2003 that a person did not consent to the relevant act if the defendant “intentionally induced the complainant to consent to the relevant act by impersonating a person known personally to the complainant”. S.4 could apply to the particular facts of this case, given Ms Bhogal impersonated ‘Bobby’ who was known to Ms Assi.
• Child sex offences (sections 9-15A, Sexual Offences Act 2003 and section 1, Protection of Children Act 1978) - Catfishing can be used as a way to commit child sex offences, such as sexual communications with a child and possession of indecent photographs of children. 26 year old Alexander McCartney was sentenced to life in prison after he created multiple fake accounts on online platforms, posing as a teenage girl, in order to groom other teenage girls to send him indecent images or engage in sexual activity using a webcam or mobile phone. The court found that the 185 charges were committed “under the umbrella term of catfishing” (R v Alexander McCartney [2024] NICC 30).

Conduct associated with catfishing may also involve the following offences:

• Harassment (section 2, Protection from Harassment Act 1997) - Persistently causing distress such as sending threatening messages or emotionally manipulating the victim
• Revenge porn (section 33, Criminal Justice and Courts Act 2015) - Sharing or threatening to share or use intimate images or videos, with intent to cause distress.
• False/malicious communications (section 1, Malicious Communications Act): sending grossly offensive, indecent or threatening messages through fake profiles. This conduct may also fall under the section 179 of the Online Safety Act when it comes into force.

Looking ahead
 

Ms. Assi continues to campaign for catfishing to be recognised as a criminal offence, advocating for stronger protections to address this growing issue. While there is currently no specifically designed legislation to protect victims of catfishing, Ms Assi’s successful civil case demonstrates that existing privacy and data protection laws can still help victims – enabling them to seek financial compensation and offering some sense of accountability when criminal charges are not brought. However, catfishing commonly involves the commission of multiple other offences which should be considered notwithstanding the absence of an offence of ‘catfishing’ on the statute books.

Further information

If you have any questions regarding this blog, please contact Lavanya Loganathan or Sophie Tang.

About the authors