One day earlier this month, Jim Vidmar bought 1,000 fake Twitter accounts for $58 from an online vendor in Pakistan. 
 
 Mr. Vidmar programs accounts like these to "follow" other Twitter accounts, and to rebroadcast tweets. 
 
 Rapper Dave Murrell, who calls himself Fyrare and has paid Mr. Vidmar to log into Mr. Murrell's Twitter account and "follow" other people to boost his popularity on the social network, says... ||||| The real Jessica Rychly is a Minnesota teenager with a broad smile and wavy hair. She likes reading and the rapper Post Malone. When she goes on Facebook or Twitter, she sometimes muses about being bored or trades jokes with friends. Occasionally, like many teenagers, she posts a duck-face selfie. 
 
 But on Twitter, there is a version of Jessica that none of her friends or family would recognize. While the two Jessicas share a name, photograph and whimsical bio — “I have issues” — the other Jessica promoted accounts hawking Canadian real estate investments, cryptocurrency and a radio station in Ghana. The fake Jessica followed or retweeted accounts using Arabic and Indonesian, languages the real Jessica does not speak. While she was a 17-year-old high school senior, her fake counterpart frequently promoted graphic pornography, retweeting accounts called Squirtamania and Porno Dan. 
 
 All these accounts belong to customers of an obscure American company named Devumi that has collected millions of dollars in a shadowy global marketplace for social media fraud. Devumi sells Twitter followers and retweets to celebrities, businesses and anyone who wants to appear more popular or exert influence online. Drawing on an estimated stock of at least 3.5 million automated accounts, each sold many times over, the company has provided customers with more than 200 million Twitter followers, a New York Times investigation found. 
 
 The accounts that most resemble real people, like Ms. Rychly, reveal a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to a Times data analysis. 
 
 “I don’t want my picture connected to the account, nor my name,” Ms. Rychly, now 19, said. “I can’t believe that someone would even pay for it. It is just horrible.” 
 
 These accounts are counterfeit coins in the booming economy of online influence, reaching into virtually any industry where a mass audience — or the illusion of it — can be monetized. Fake accounts, deployed by governments, criminals and entrepreneurs, now infest social media networks. By some calculations, as many as 48 million of Twitter’s reported active users — nearly 15 percent — are automated accounts designed to simulate real people, though the company claims that number is far lower. 
 
 In November, Facebook disclosed to investors that it had at least twice as many fake users as it previously estimated, indicating that up to 60 million automated accounts may roam the world’s largest social media platform. These fake accounts, known as bots, can help sway advertising audiences and reshape political debates. They can defraud businesses and ruin reputations. Yet their creation and sale fall into a legal gray zone. 
 
 “The continued viability of fraudulent accounts and interactions on social media platforms — and the professionalization of these fraudulent services — is an indication that there’s still much work to do,” said Senator Mark Warner, the Virginia Democrat and ranking member of the Senate Intelligence Committee, which has been investigating the spread of fake accounts on Facebook, Twitter and other platforms. 
 
 Despite rising criticism of social media companies and growing scrutiny by elected officials, the trade in fake followers has remained largely opaque. While Twitter and other platforms prohibit buying followers, Devumi and dozens of other sites openly sell them. And social media companies, whose market value is closely tied to the number of people using their services, make their own rules about detecting and eliminating fake accounts. 
 
 Devumi’s founder, German Calas, denied that his company sold fake followers and said he knew nothing about social identities stolen from real users. “The allegations are false, and we do not have knowledge of any such activity,” Mr. Calas said in an email exchange in November. 
 
 The Times reviewed business and court records showing that Devumi has more than 200,000 customers, including reality television stars, professional athletes, comedians, TED speakers, pastors and models. In most cases, the records show, they purchased their own followers. In others, their employees, agents, public relations companies, family members or friends did the buying. For just pennies each — sometimes even less — Devumi offers Twitter followers, views on YouTube, plays on SoundCloud, the music-hosting site, and endorsements on LinkedIn, the professional-networking site. 
 
 The actor John Leguizamo has Devumi followers. So do Michael Dell, the computer billionaire, and Ray Lewis, the football commentator and former Ravens linebacker. Kathy Ireland, the onetime swimsuit model who today presides over a half-billion-dollar licensing empire, has hundreds of thousands of fake Devumi followers, as does Akbar Gbajabiamila, the host of the show “American Ninja Warrior.” Even a Twitter board member, Martha Lane Fox, has some. 
 
 At a time when Facebook, Twitter and Google are grappling with an epidemic of political manipulation and fake news, Devumi’s fake followers also serve as phantom foot soldiers in political battles online. Devumi’s customers include both avid supporters and fervent critics of President Trump, and both liberal cable pundits and a reporter at the alt-right bastion Breitbart. Randy Bryce, an ironworker seeking to unseat Representative Paul Ryan of Wisconsin, purchased Devumi followers in 2015, when he was a blogger and labor activist. Louise Linton, the wife of the Treasury secretary, Steven Mnuchin, bought followers when she was trying to gain traction as an actress. 
 
 Devumi’s products serve politicians and governments overseas, too. An editor at China’s state-run news agency, Xinhua, paid Devumi for hundreds of thousands of followers and retweets on Twitter, which the country’s government has banned but sees as a forum for issuing propaganda abroad. An adviser to Ecuador’s president, Lenín Moreno, bought tens of thousands of followers and retweets for Mr. Moreno’s campaign accounts during last year’s elections. 
 
 Kristin Binns, a Twitter spokeswoman, said the company did not typically suspend users suspected of buying bots, in part because it is difficult for the business to know who is responsible for any given purchase. Twitter would not say whether a sample of fake accounts provided by The Times — each based on a real user — violated the company’s policies against impersonation. 
 
 “We continue to fight hard to tackle any malicious automation on our platform as well as false or spam accounts,” Ms. Binns said. 
 
 Unlike some social media companies, Twitter does not require accounts to be associated with a real person. It also permits more automated access to its platform than other companies, making it easier to set up and control large numbers of accounts. 
 
 Three Types of Twitter Bots Tweets from a Twitter bot look just like those of a normal user, but a bot’s tweets are generated by a computer program, rather than a person. Below are three examples of common bot types you might encounter on Twitter and an approximation of the code controls them. By Richard Harris and Danny DeBelius 
 
 “Social media is a virtual world that is filled with half bots, half real people,” said Rami Essaid, the founder of Distil Networks, a cybersecurity company that specializes in eradicating bot networks. “You can’t take any tweet at face value. And not everything is what it seems.” 
 
 Including, it turns out, Devumi itself. 
 
 The Influence Economy 
 
 Last year, three billion people logged on to social media networks like Facebook, WhatsApp and China’s Sina Weibo. The world’s collective yearning for connection has not only reshaped the Fortune 500 and upended the advertising industry but also created a new status marker: the number of people who follow, like or “friend” you. For some entertainers and entrepreneurs, this virtual status is a real-world currency. Follower counts on social networks help determine who will hire them, how much they are paid for bookings or endorsements, even how potential customers evaluate their businesses or products. 
 
 High follower counts are also critical for so-called influencers, a budding market of amateur tastemakers and YouTube stars where advertisers now lavish billions of dollars a year on sponsorship deals. The more people influencers reach, the more money they make. According to data collected by Captiv8, a company that connects influencers to brands, an influencer with 100,000 followers might earn an average of $2,000 for a promotional tweet, while an influencer with a million followers might earn $20,000. 
 
 Genuine fame often translates into genuine social media influence, as fans follow and like their favorite movie stars, celebrity chefs and models. But shortcuts are also available: On sites like Social Envy and DIYLikes.com, it takes little more than a credit-card number to buy a huge following on almost any social media platform. Most of these sites offer what they describe as “active” or “organic” followers, never quite stating whether real people are behind them. Once purchased, the followers can be a powerful tool. 
 
 “You see a higher follower count, or a higher retweet count, and you assume this person is important, or this tweet was well received,” said Rand Fishkin, the founder of Moz, a company that makes search engine optimization software. “As a result, you might be more likely to amplify it, to share it or to follow that person.” 
 
 Twitter and Facebook can be similarly influenced. “Social platforms are trying to recommend stuff — and they say, ‘Is the stuff we are recommending popular?’” said Julian Tempelsman, the co-founder of Smyte, a security firm that helps companies combat online abuse, bots and fraud. “Follower counts are one of the factors social media platforms use.” 
 
 Search on Google for how to buy more followers, and Devumi often turns up among the first results. Visitors are greeted by a polished website listing a Manhattan address, displaying testimonials from customers and a money-back guarantee. Best of all, Devumi claims, the company’s products are blessed by the platform for which they are selling followers. “We only use promotion techniques that are Twitter approved so your account is never at risk of getting suspended or penalized,” Devumi’s website promises. 
 
 To better understand Devumi’s business, we became a customer. In April, The Times set up a test account on Twitter and paid Devumi $225 for 25,000 followers, or about a penny each. As advertised, the first 10,000 or so looked like real people. They had pictures and full names, hometowns and often authentic-seeming biographies. One account looked like that of Ms. Rychly, the young Minnesota woman. 
 
 But on closer inspection, some of the details seemed off. The account names had extra letters or underscores, or easy-to-miss substitutions, like a lowercase “L” in place of an uppercase “I.” 
 
 How to Spot a Devumi Bot Devumi claims to use its own “private network of hand-picked real and active Twitter users and influencers”. In reality, it sells bots with stolen profiles. Here are the details that give them away. By Richard Harris and Danny DeBelius 
 
 The next 15,000 followers from Devumi were more obviously suspect: no profile pictures, and jumbles of letters, numbers and word fragments instead of names. 
 
 In August, a Times reporter emailed Mr. Calas, asking if he would answer questions about Devumi. Mr. Calas did not respond. Twitter forbids selling or buying followers or retweets, and Devumi promises customers absolute discretion. “Your info is always kept confidential,” the company’s website reads. “Our followers look like any other followers and are always delivered naturally. The only way anyone will know is if you tell them.” 
 
 Buying Bots 
 
 But company records reviewed by The Times revealed much of what Devumi and its customers prefer to conceal. 
 
 Most of Devumi’s best-known buyers are selling products, services or themselves on social media. In interviews, their explanations varied. They bought followers because they were curious about how it worked, or felt pressure to generate high follower counts for themselves or their customers. “Everyone does it,” said the actress Deirdre Lovejoy, a Devumi customer. 
 
 While some said they believed Devumi was supplying real potential fans or customers, others acknowledged that they knew or suspected they were getting fake accounts. Several said they regretted their purchases. 
 
 “It’s fraud,” said James Cracknell, a British rower and Olympic gold medalist who bought 50,000 followers from Devumi. “People who judge by how many likes or how many followers, it’s not a healthy thing.” 
 
 Ms. Ireland has over a million followers on Twitter, which she often uses to promote companies with whom she has endorsement deals. The Wisconsin-based American Family Insurance, for example, said that the former model was one of its most influential Twitter “brand ambassadors,” celebrities who are paid to help promote products. 
 
 But in January last year, Ms. Ireland had only about 160,000 followers. The next month, an employee at the branding agency she owns, Sterling/Winters, spent about $2,000 for 300,000 more followers, according to Devumi records. The employee later made more purchases, he acknowledged in an interview. Much of Ms. Ireland’s Twitter following appears to consist of bots, a Times analysis found. 
 
 A spokeswoman said that the employee had acted without Ms. Ireland’s authorization and had been suspended after The Times asked about the purchases. “I’m sure he thought he was fulfilling his duties, but it’s not something he should have done,” said the spokeswoman, Rona Menashe. 
 
 Similarly, Ms. Lane Fox, a British e-commerce pioneer, member of Parliament and Twitter board member, blamed a “rogue employee” for a series of follower purchases spanning more than a year. She declined to name the person. 
 
 Several Devumi customers or their representatives contacted by The Times declined to comment, among them Mr. Leguizamo, whose followers were bought by an associate. Many more did not respond to repeated efforts to contact them. 
 
 A few denied making Devumi purchases. They include Ashley Knight, Mr. Lewis’s personal assistant, whose email address was listed on an order for 250,000 followers, and Eric Kaplan, a friend to Mr. Trump and motivational speaker whose personal email address was associated with eight orders. A Twitter account belonging to Paul Hollywood, the celebrity baker, was deleted after The Times emailed him with questions. Mr. Hollywood then sent a reply: “Account does not exist.” 
 
 Devumi’s Web Many of these celebrities, business leaders, sports stars and other Twitter users bought their own followers, records show. In other cases, the purchases were made by their employees, agents, family members or other associates. By Richard Harris and Danny DeBelius 
 
 Over two years, the Democratic public relations consultant and CNN contributor Hilary Rosen bought more than a half-million fake followers from Devumi. Ms. Rosen previously spent more than a decade as head of the Recording Industry Association of America. In an interview, she described the purchases as “an experiment I did several years ago to see how it worked.” She made more than a dozen purchases of followers from 2015 to 2017, according to company records. 
 
 Other buyers said they had faced pressure from employers to generate social media followers. Marcus Holmlund, a young freelance writer, was at first thrilled when Wilhelmina, the international modeling agency, hired him to manage its social media efforts. But when Wilhelmina’s Twitter following didn’t grow fast enough, Mr. Holmlund said, a supervisor told him to buy followers or find another job. In 2015, despite misgivings, he began making monthly Devumi purchases out of his own pocket. 
 
 “I felt stuck with the threat of being fired, or worse, never working in fashion again,” said Mr. Holmlund, who left in late 2015. “Since then, I tell anyone and everyone who ever asks that it’s a total scam — it won’t boost their engagement.” (A Wilhelmina spokeswoman declined to comment.) 
 
 Several Devumi customers acknowledged that they bought bots because their careers had come to depend, in part, on the appearance of social media influence. “No one will take you seriously if you don’t have a noteworthy presence,” said Jason Schenker, an economist who specializes in economic forecasting and has purchased at least 260,000 followers. 
 
 Not surprisingly, Devumi has sold millions of followers and retweets to entertainers on the lower and middle rungs of Hollywood, such as the actor Ryan Hurst, a star of the television series “Sons of Anarchy.” In 2016 and 2017, he bought a total of 750,000 followers, about three-quarters of his current count. It cost less than $4,000, according to company records. Mr. Hurst did not respond to multiple requests for comment. 
 
 Devumi also sells bots to reality television stars, who can parlay fame into endorsement and appearance fees. Sonja Morgan, a cast member on the Bravo show “The Real Housewives of New York City,” uses her Devumi-boosted Twitter feed to promote her fashion line, a shopping app and a website that sells personalized “video shout-outs.” One former “American Idol” contestant, Clay Aiken, even paid Devumi to spread a grievance: his customer service complaint against Volvo. Devumi bots retweeted his complaint 5,000 times. 
 
 Mr. Aiken and Ms. Morgan did not respond to requests for comment. 
 
 More than a hundred self-described influencers — whose market value is even more directly linked to their follower counts on social media — have purchased Twitter followers from Devumi. Justin Blau, a popular Las Vegas-based D.J. who performs as 3LAU, acquired 50,000 followers and thousands of retweets. In an email, Mr. Blau said a former member of his management team bought them without his approval. 
 
 At least five Devumi influencer customers are also contractors for HelloSociety, an influencer agency owned by The New York Times Company. (A Times spokeswoman said the company sought to verify that the audience of each contractor was legitimate and would not do business with anyone who violated that standard.) Lucas Peterson, a freelance journalist who writes a travel column for The Times, also bought followers from Devumi. 
 
 Influencers need not be well known to rake in endorsement money. According to a recent profile in the British tabloid The Sun, two young siblings, Arabella and Jaadin Daho, earn a combined $100,000 a year as influencers, working with brands such as Amazon, Disney, Louis Vuitton and Nintendo. Arabella, who is 14, tweets under the name Amazing Arabella. 
 
 But her Twitter account — and her brother’s — are boosted by thousands of retweets purchased by their mother and manager, Shadia Daho, according to Devumi records. Ms. Daho did not respond to repeated attempts to reach her by email and through a public relations firm. 
 
 While Devumi sells millions of followers directly to celebrities and influencers, its customers also include marketing and public relations agencies, which buy followers for their own customers. Phil Pallen, a brand strategist based in Los Angeles, offers customers “growth & ad campaigns” on social media. At least a dozen times, company records show, Mr. Pallen has paid Devumi to deliver those results. Beginning in 2014, for example, he purchased tens of thousands of followers for Lori Greiner, the inventor and “Shark Tank” co-host. 
 
 Mr. Pallen at first denied buying those followers. After The Times contacted Ms. Greiner, Mr. Pallen said he had “experimented” with the company but “stopped using it long ago.” A lawyer for Ms. Greiner said she had asked him to stop after learning of the first purchases. 
 
 Still, records show, Mr. Pallen bought Ms. Greiner more Devumi followers in 2016. 
 
 Marketing consultants sometimes buy followers for themselves, too, in effect purchasing the evidence of their supposed expertise. In 2015, Jeetendr Sehdev, a former adjunct professor at the University of Southern California who calls himself “the world’s leading celebrity branding authority,” began buying hundreds of thousands of fake followers from Devumi. 
 
 He did not respond to requests for comment. But in his recent best-selling book, “The Kim Kardashian Principle: Why Shameless Sells,” he had a different explanation for his rising follower count. “My social media following exploded,” Mr. Sehdev claimed, because he had discovered the true secret to celebrity influence: “Authenticity is the key.” 
 
 Stolen and Sold 
 
 Among the followers delivered to Mr. Sehdev was Ms. Rychly — or at least, a copy of her. The fake Rychly account, created in 2014, was included in the purchase orders of hundreds of Devumi customers. It was retweeted by Mr. Schenker, the economist, and Arabella Daho, the teenage influencer. Clive Standen, star of the show “Taken,” ended up with Ms. Rychly’s stolen social identity. So did the television baker Mr. Hollywood, the French entertainer DJ Snake and Ms. Ireland. (DJ Snake’s followers were purchased by a former manager, and Mr. Standen did not respond to requests for comment.) 
 
 The fake Ms. Rychly also retweeted at least five accounts linked to a prolific American pornographer named Dan Leal, who is based in Hungary and tweets as @PornoDan. Mr. Leal, who has bought at least 150,000 followers from Devumi in recent years, is one of at least dozens of customers who work in the adult film industry or as escorts, according to a review of Devumi records. 
 
 In an email, Mr. Leal said that buying followers for his business generated more than enough new revenue to pay for the expense. He was not worried about being penalized by Twitter, Mr. Leal said. “Countless public figures, companies, music acts, etc. purchase followers,” he wrote. “If Twitter was to purge everyone who did so there would be hardly any of them on it.” 
 
 Devumi has sold at least tens of thousands of similar high-quality bots, a Times analysis found. In some cases, a single real Twitter user was transformed into hundreds of different bots, each a minute variation on the original. 
 
 Families of bots Individually, fake accounts are hard to detect. Study their group behaviour, and incriminating patterns begin to emerge. By Richard Harris and Mark Hansen 
 
 These fake accounts borrowed social identities from Twitter users in every American state and dozens of countries, from adults and minors alike, from highly active users and those who hadn’t logged in to their accounts for months or years. 
 
 Sam Dodd, a college student and aspiring filmmaker, set up his Twitter account as a high school sophomore in Maryland. Before he even graduated, his Twitter details were copied onto a bot account. 
 
 The fake account remained dormant until last year, when it suddenly began retweeting Devumi customers continuously. This summer, the fake Mr. Dodd promoted various pornographic accounts, including Mr. Leal’s Immoral Productions, as well as a link to a gambling website. 
 
 “I don’t know why they’d take my identity — I’m a 20-year-old college student,” Mr. Dodd said. “I’m not well known.” But even unknown, Mr. Dodd’s social identity has value in the influence economy. At prices posted in December, Devumi was selling high-quality followers for under two cents each. Sold to about 2,000 customers — the rough number that many Devumi bot accounts follow — his social identity could bring Devumi around $30. 
 
 The stolen social identities of Twitter users like Mr. Dodd are critical to Devumi’s brand. The high-quality bots are usually delivered to customers first, followed by millions of cheaper, low-quality bots, like sawdust mixed in with grated Parmesan. 
 
 Some of Devumi’s high-quality bots, in effect, replace an idle Twitter account — belonging to someone who stopped using the service — with a fake one. Whitney Wolfe, an executive assistant who lives in Florida, opened a Twitter account in 2008, when she was a wedding planner. By the time she stopped using it regularly in 2014, a fake account copying her personal information had been created. In recent months, it has retweeted adult film actresses, several influencers and an escort turned memoirist. 
 
 “The content — pictures of women in thongs, pictures of women’s chests — it’s not anything I want to be represented with my faith, my name, where I live,” said Ms. Wolfe, who is active in her local Southern Baptist congregation. 
 
 Other victims were still active on Twitter when Devumi-sold bots began impersonating them. Salle Ingle, a 40-year-old engineer who lives in Colorado, said she worried that a potential employer would come across the fake version of her while vetting her social media accounts. 
 
 “I’ve been applying for new jobs, and I’m really grateful that no one saw this account and thought it was me,” Ms. Ingle said. Once contacted by The Times, Ms. Ingle reported the account to Twitter, which deactivated it. 
 
 After emailing Mr. Calas last year, a Times reporter visited Devumi’s Manhattan address, listed on its website. The building has dozens of tenants, including a medical clinic and a labor union. But Devumi and its parent company, Bytion, do not appear to be among them. A spokesman for the building’s owner said neither Devumi nor Bytion had ever rented space there. 
 
 Like the followers Devumi sold, the office was an illusion. 
 
 Man of Mysteries 
 
 In real life, Devumi is based in a small office suite above a Mexican restaurant in West Palm Beach, Fla., overlooking an alley crowded with Dumpsters and parked cars. Mr. Calas lives a short commute away, in a penthouse apartment. 
 
 On his LinkedIn profile, Mr. Calas is described as a “serial entrepreneur,” with a long record in the tech business and an advanced degree from the Massachusetts Institute of Technology. But Mr. Calas’s persona, too, is a mixture of fact and fantasy. 
 
 Mr. Calas, who is 27, grew up in South Florida, where as a teenager he learned web design and built sites for local businesses, according to earlier versions of his personal web page available on the Internet Archive. 
 
 Eventually he taught himself techniques for search engine optimization — the art of pushing a web page higher in search results. While in high school, he began taking classes at Palm Beach State College, where he earned an associate degree in 2012, according to a school spokeswoman. Within a few years, Mr. Calas was claiming to have built dozens of online businesses serving 10 million customers, now under the Bytion umbrella. 
 
 “I started this company with a thousand dollars in the bank, without investors, and only the burning passion for success,” Mr. Calas wrote last year on the job-listing site Glassdoor. 
 
 As Mr. Calas’s ambitions grew, so did his embroidery. A copy of his résumé posted online in 2014 claimed that he earned a physics degree from Princeton University in 2000, when he would have been about 10 years old, and a Ph.D. in computer science from M.I.T. Representatives for both schools said they had no record of Mr. Calas’s attending their institution. His current LinkedIn page says that he has a master’s degree in “international business” from M.I.T., a degree it does not offer. 
 
 According to former employees interviewed by The Times, turnover was high at Devumi, and Mr. Calas kept his operation tightly compartmentalized. Employees sometimes had little idea what their colleagues were doing, even if they were working on the same project. 
 
 The ex-employees asked for anonymity for fear of lawsuits or because they were subject to nondisclosure agreements with Mr. Calas’s companies. But their comments are echoed in reviews on Glassdoor, where some former employees said that Mr. Calas was uncommunicative and demanded that they install monitoring software on their personal devices. 
 
 Dozens of Devumi’s customer service and order fulfillment personnel are based in the Philippines, according to company records. Employing overseas contractors may have helped Mr. Calas hold down costs. But it also appears to have left him vulnerable to a kind of social identity theft himself. 
 
 Last August, Mr. Calas sued Ronwaldo Boado, a Filipino contractor who previously worked for Devumi as an assistant customer support manager. After being fired for squabbling with other members of his team, Mr. Boado took control of a Devumi email account listing more than 170,000 customer orders, Mr. Calas alleged in court papers. Then Mr. Boado created a fake Devumi. (Some details of the lawsuit and of Devumi were previously reported by the Bureau of Investigative Journalism.) 
 
 His copycat company used a similar name — DevumiBoost — and copied the design of Devumi’s website, Mr. Calas alleged. The fake Devumi even listed the same phantom Manhattan address. Over a stretch of days last July, Mr. Boado, posing as a Devumi employee, emailed hundreds of Devumi customers to inform them that their orders needed to be reprocessed on DevumiBoost. Then he impersonated the customers, too, emailing Devumi under different aliases to ask that Devumi cancel the original orders. Mr. Boado, according to Mr. Calas, was trying to steal his customers. (Mr. Boado did not respond to emails seeking a response to Mr. Calas’s claims.) 
 
 Mr. Calas’s lawsuit also revealed something else: Devumi doesn’t appear to make its own bots. Instead, the company buys them wholesale — from a thriving global market of fake social media accounts. 
 
 The Social Supply Chain 
 
 Scattered around the web is an array of obscure websites where anonymous bot makers around the world connect with retailers like Devumi. While individual customers can buy from some of these bare-boned sites — Peakerr, CheapPanel and YTbot, among others — they are less user-friendly. Some, for example, do not accept credit cards, only cryptocurrencies like Bitcoin. 
 
 But each site sells followers, likes and shares in bulk, for a variety of social media platforms and in different languages. The accounts they sell may change hands repeatedly. The same account may even be available from more than one seller. 
 
 Devumi, according to one former employee, sourced bots from different bot makers depending on price, quality and reliability. On Peakerr, for example, 1,000 high-quality, English-language bots with photos costs a little more than a dollar. Devumi charges $17 for the same quantity. 
 
 The price difference has allowed Mr. Calas to build a small fortune, according to company records. In just a few years, Devumi sold about 200 million Twitter followers to at least 39,000 customers, accounting for a third of more than $6 million in sales during that period. 
 
 Last month, Mr. Calas asked for examples of bots The Times found that copied real users. After receiving the names of 10 accounts, Mr. Calas, who had agreed to an interview, asked for more time to analyze them. Then he stopped responding to emails. 
 
 Ms. Binns, the Twitter spokeswoman, said the company did not proactively review accounts to see if they were impersonating other users. Instead, the company’s efforts are focused on identifying and suspending accounts that violate Twitter’s spam policies. In December, for example, the company identified an average of 6.4 million suspicious accounts each week, she said. 
 
 All of the sample accounts provided by The Times violated Twitter’s anti-spam policies and were shut down, Ms. Binns said. “We take the action of suspending an account from the platform very seriously,” she said. “At the same time, we want to aggressively fight spam on the platform.” 
 
 The company also suspended Devumi’s account on Saturday after the Times article was published online. 
 
 Yet Twitter has not imposed seemingly simple safeguards that would help throttle bot manufacturers, such as requiring anyone signing up for a new account to pass an anti-spam test, as many commercial sites do. As a result, Twitter now hosts vast swaths of unused accounts, including what are probably dormant accounts controlled by bot makers. 
 
 Former employees said the company’s security team for many years was more focused on abuse by real users, including racist and sexist content and orchestrated harassment campaigns. Only recently, they said, after revelations that Russia-aligned hackers had deployed networks of Twitter bots to spread divisive content and junk news, has Twitter turned more attention to weeding out fake accounts. 
 
 Leslie Miley, an engineer who worked on security and user safety at Twitter before leaving in late 2015, said, “Twitter as a social network was designed with almost no accountability.” 
 
 Some critics believe Twitter has a business incentive against weeding out bots too aggressively. Over the past two years, the company has struggled to generate the user growth seen by rivals like Facebook and Snapchat. And outside researchers have disputed the company’s estimates for how many of its active users are actually bots. 
 
 The Evolution of Twitter’s Timeline Small design changes over a number of years has placed an increasingly greater focus on user engagement with replies, retweets and likes in Twitter’s timeline. By Richard Harris and Danny DeBelius 
 
 “We’re working with completely unregulated, closed ecosystems that aren’t reporting on these things. They have a perverse incentive to let it happen,” said Mr. Essaid, the cybersecurity expert. “They want to police it to the extent it doesn’t seem obvious, but they make money off it.” 
 
 In January, after almost two years of promoting hundreds of Devumi customers, the fake Jessica Rychly account was finally flagged by Twitter’s security algorithms. It was recently suspended. 
 
 But the real Ms. Rychly may soon leave Twitter for good. 
 
 “I am probably just going to delete my Twitter account,” she said. ||||| We believe that everyone should have the power to create and share ideas and information instantly, without barriers. In order to protect the experience and safety of people who use Twitter, there are some limitations on the type of content and behavior that we allow. These limitations are set forth in the Twitter Rules below. 
 
 The Twitter Rules (along with all incorporated policies), Privacy Policy, and Terms of Service collectively make up the "Twitter User Agreement" that governs a user's access to and use of Twitter's services. 
 
 All individuals accessing or using Twitter’s services must adhere to the policies set forth in the Twitter Rules. Failure to do so may result in Twitter taking one or more of the following enforcement actions: 
 
 requiring you to remove prohibited content before you can again create new posts and interact with other Twitter users; 
 
 temporarily limiting your ability to create posts or interact with other Twitter users; 
 
 asking you to verify account ownership with a phone number or email address; or 
 
 permanently suspending your account(s). 
 
 If you attempt to evade a permanent suspension by creating new accounts, we will suspend your new accounts. 
 
 Please note that we may need to change these Rules from time to time and reserve the right to do so. The most current version is always available at: https://twitter.com/rules. 
 
 The policies set forth in these Twitter Rules govern organic content on our platform. To learn more about the rules which govern ads and promoted content, please review our Ads policies. 
 
 Content Boundaries and Use of Twitter 
 
 Intellectual property 
 
 Trademark: We reserve the right to suspend accounts or take other appropriate action when someone’s brand or trademark, including business name and/or logo, is used in a manner that may mislead or confuse others about your brand affiliation. Read more about our trademark policy and how to report a violation. 
 
 Copyright: We will respond to clear and complete notices of alleged copyright infringement. Our copyright procedures are set forth in our Terms of Service. Read more about our copyright policy. 
 
 
 
 Graphic violence and adult content 
 
 We consider graphic violence to be any form of gory media related to death, serious injury, violence, or surgical procedures. We consider adult content to be any media that is pornographic and/or may be intended to cause sexual arousal. 
 
 Twitter allows some forms of graphic violence and/or adult content in Tweets marked as containing sensitive media. However, you may not use such content in live video, your profile, or header images. Additionally, Twitter may sometimes require you to remove excessively graphic violence. Read more about how we define graphic violence and adult content and how to mark your media as sensitive. 
 
 Media depicting deceased individuals: We may require you to remove media that depicts the death of an identifiable individual if we receive a request from their family or an authorized representative. Learn more about how to make such a request. 
 
 
 
 
 
 Unlawful use 
 
 You may not use our service for any unlawful purposes or in furtherance of illegal activities. By using Twitter, you agree to comply with all applicable laws governing your online conduct and content. 
 
 
 
 Distribution of hacked materials 
 
 We do not permit the use of our services to directly distribute content obtained through hacking that contains personally identifiable information, may put people in imminent harm or danger, or contains trade secrets. Direct distribution of hacked materials includes posting hacked content on Twitter (for instance, in the text of a Tweet, or in an image), or directly linking to hacked content hosted on other websites. 
 
 We may suspend accounts which directly distribute hacked materials where the account has made a claim of responsibility for a hack, or where Twitter is able to reliably attribute a hack to the account distributing that content. 
 
 
 
 Trends 
 
 At times, we may prevent certain content from trending. This includes content that violates the Twitter Rules, as well as content that may attempt to manipulate trends. Read more about what we allow and do not allow to trend. 
 
 
 
 Third-party advertising in video content 
 
 You may not submit, post, or display any video content on or through our services that includes third-party advertising, such as pre-roll video ads or sponsorship graphics, without our prior consent. 
 
 
 
 Misuse of Twitter badges 
 
 You may not use badges, including but not limited to the “promoted” or “verified” Twitter badges, unless provided by Twitter. Accounts using unauthorized badges as part of their profile photos, header photos, display names, or in any way that falsely implies affiliation with Twitter or authorization from Twitter to display these badges, may be suspended. 
 
 
 
 Misuse of usernames 
 
 Selling usernames: You may not buy or sell Twitter usernames. 
 
 Username squatting: You may not engage in username squatting. Some of the factors we take into consideration when determining whether conduct is username squatting include: 
 
 the number of accounts created; 
 
 the creation of accounts for the purpose of preventing others from using those account names; 
 
 the creation of accounts for the purpose of selling those accounts; and 
 
 the use of third-party content feeds to update and maintain accounts under the names of those third parties. 
 
 Please note that Twitter may also remove accounts that are inactive for more than six months. Learn more about username squatting. 
 
 Abusive Behavior 
 
 We believe in freedom of expression and open dialogue, but that means little as an underlying philosophy if voices are silenced because people are afraid to speak up. In order to ensure that people feel safe expressing diverse opinions and beliefs, we prohibit behavior that crosses the line into abuse, including behavior that harasses, intimidates, or uses fear to silence another user’s voice. 
 
 Context matters when evaluating for abusive behavior and determining appropriate enforcement actions. Factors we may take into consideration include, but are not limited to whether: 
 
 the behavior is targeted at an individual or group of people; 
 
 the report has been filed by the target of the abuse or a bystander; 
 
 the behavior is newsworthy and in the legitimate public interest. 
 
 
 
 Violence and physical harm 
 
 Violence: You may not make specific threats of violence or wish for the serious physical harm, death, or disease of an individual or group of people. This includes, but is not limited to, threatening or promoting terrorism. You also may not affiliate with organizations that — whether by their own statements or activity both on and off the platform — use or promote violence against civilians to further their causes. 
 
 
 
 Suicide or self-harm: You may not promote or encourage suicide or self-harm. When we receive reports that a person is threatening suicide or self-harm, we may take a number of steps to assist them, such as reaching out to that person and providing resources such as contact information for our mental health partners. 
 
 Child sexual exploitation: You may not promote child sexual exploitation. Learn more about our zero-tolerance child sexual exploitation policy. 
 
 
 
 Abuse and hateful conduct 
 
 Abuse: You may not engage in the targeted harassment of someone, or incite other people to do so. We consider abusive behavior an attempt to harass, intimidate, or silence someone else’s voice. 
 
 Unwanted sexual advances: You may not direct abuse at someone by sending unwanted sexual content, objectifying them in a sexually explicit manner, or otherwise engaging in sexual misconduct. 
 
 Hateful conduct: You may not promote violence against, threaten, or harass other people on the basis of race, ethnicity, national origin, sexual orientation, gender, gender identity, religious affiliation, age, disability, or serious disease. Read more about our hateful conduct policy. 
 
 Hateful imagery and display names: You may not use hateful images or symbols in your profile image or profile header. You also may not use your username, display name, or profile bio to engage in abusive behavior, such as targeted harassment or expressing hate towards a person, group, or protected category. 
 
 
 
 
 
 Private information and intimate media 
 
 Private information: You may not publish or post other people's private information without their express authorization and permission. Definitions of private information may vary depending on local laws. Read more about our private information policy. 
 
 Intimate media: You may not post or share intimate photos or videos of someone that were produced or distributed without their consent. Media depicting sexual violence and/or assault is also not permitted. Note: limited exceptions may apply if there is clear context that the interaction is consensual. Read more about intimate media on Twitter. 
 
 Threats to expose / hack: You may not threaten to expose someone’s private information or intimate media. You also may not threaten to hack or break into someone’s digital information or attempt to incentivize others to do so (e.g., through setting a bounty or reward on such actions). 
 
 
 
 
 
 Impersonation 
 
 You may not impersonate individuals, groups, or organizations in a manner that is intended to or does mislead, confuse, or deceive others. While you may maintain parody, fan, commentary, or newsfeed accounts, you may not do so if the intent of the account is to engage in spamming or abusive behavior. Read more about our impersonation policy. 
 
 Spam and Security 
 
 We strive to protect people on Twitter from technical abuse and spam. 
 
 To promote a stable and secure environment on Twitter, you may not do, or attempt to do, any of the following while accessing or using Twitter: 
 
 Access, tamper with, or use non-public areas of Twitter, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers (except as expressly permitted by the Twitter Bug Bounty program). 
 
 Probe, scan, or test the vulnerability of any system or network, or breach or circumvent any security or authentication measures (except as expressly permitted by the Twitter Bug Bounty program). 
 
 Access or search, or attempt to access or search, Twitter by any means (automated or otherwise) other than through our currently available, published interfaces that are provided by Twitter (and only pursuant to the applicable terms and conditions), unless you have been specifically allowed to do so in a separate agreement with Twitter. Note that crawling Twitter is permissible if done in accordance with the provisions of the robots.txt file; however, scraping Twitter without our prior consent is expressly prohibited. 
 
 Forge any TCP/IP packet header or any part of the header information in any email or posting, or in any way use Twitter to send altered, deceptive, or false source-identifying information. 
 
 Interfere with or disrupt the access of any user, host or network, including, without limitation, sending a virus, overloading, flooding, spamming, mail-bombing Twitter’s services, or by scripting the creation of content in such a manner as to interfere with or create an undue burden on Twitter. 
 
 Any accounts engaging in the following activities may be temporarily locked or subject to permanent suspension: 
 
 Malware/Phishing: You may not publish or link to malicious content intended to damage or disrupt another person’s browser or computer or to compromise a person’s privacy. 
 
 You may not publish or link to malicious content intended to damage or disrupt another person’s browser or computer or to compromise a person’s privacy. Fake accounts: You may not register or create fake and misleading accounts. While you may use Twitter pseudonymously or as a parody, commentary, or fan account, you may not use misleading account information in order to engage in spamming, abusive, or disruptive behavior, including attempts to manipulate the conversations on Twitter. Some of the factors that we take into account when determining whether an account is fake include: Use of stock or stolen avatar photos Use of stolen or copied profile bios Use of intentionally misleading profile information, including profile location 
 
 You may not register or create fake and misleading accounts. While you may use Twitter pseudonymously or as a parody, commentary, or fan account, you may not use misleading account information in order to engage in spamming, abusive, or disruptive behavior, including attempts to manipulate the conversations on Twitter. Some of the factors that we take into account when determining whether an account is fake include: Spam: You may not use Twitter’s services for the purpose of spamming anyone. Spam is generally defined on Twitter as bulk or aggressive activity that attempts to manipulate or disrupt Twitter or the experience of users on Twitter to drive traffic or attention to unrelated accounts, products, services, or initiatives. Some of the factors that we take into account when determining what conduct is considered to be spamming include: if you have followed and/or unfollowed a large number of of accounts in a short time period, particularly by automated means (aggressive following or follower churn); if your Tweets or Direct Messages consist mainly of links shared without commentary; if a large number of people have blocked you in response to high volumes of untargeted, unsolicited, or duplicative content or engagements from your account; if a large number of spam complaints have been filed against you; if you post duplicative or substantially similar content, replies, or mentions over multiple accounts or multiple duplicate updates on one account, or create duplicate or substantially similar accounts; if you post multiple updates to a trending or popular topic with an intent to subvert or manipulate the topic to drive traffic or attention to unrelated accounts, products, services, or initiatives; if you send large numbers of unsolicited replies or mentions; if you add users to lists in a bulk or aggressive manner; if you are randomly or aggressively engaging with Tweets (e.g., likes, Retweets, etc.) or users (e.g., following, adding to lists or Moments, etc.) to drive traffic or attention to unrelated accounts, products, services, or initiatives; if you repeatedly post other people’s account information as your own (e.g., bio, Tweets, profile URL, etc.); if you post misleading, deceptive, or malicious links (e.g., affiliate links, links to malware/clickjacking pages, etc.); if you sell, purchase, or attempt to artificially inflate account interactions (such as followers, Retweets, likes, etc.); and if you use or promote third-party services or apps that claim to get you more followers, Retweets, or likes (such as follower trains, sites promising "more followers fast", or any other site that offers to automatically add followers or engagements to your account or Tweets). 
 
 You may not use Twitter’s services for the purpose of spamming anyone. Spam is generally defined on Twitter as bulk or aggressive activity that attempts to manipulate or disrupt Twitter or the experience of users on Twitter to drive traffic or attention to unrelated accounts, products, services, or initiatives. Some of the factors that we take into account when determining what conduct is considered to be spamming include: 
 
 Please see our support articles on following rules and best practices and automation rules and best practices for more detailed information about how the Rules apply to those particular account behaviors. 
 
 Accounts created to replace or mimic suspended accounts may be permanently suspended. We may also remove accounts which Twitter is able to reliably attribute to entities known to violate the Twitter Rules. 
 
 
 
 Content Visibility 
 
 Accounts under investigation or which have been detected as sharing content in violation of these Rules may have their account or Tweet visibility limited in various parts of Twitter, including search. To learn more about situations in which content may be restricted on Twitter, please see our support article on search rules and restrictions.
– Jim Vidmar has rather unusual job: He oversees 10,000 fake Twitter accounts. And the Las Vegas man has been at it for six years, using a dozen computers and a slew of accounts to help beef up the followings of his 50-or-so clients, who pay him to help them seem more popular and important, reports the Wall Street Journal. And the accounts have gotten more sophisticated: In April, a tough new filter was applied, and the majority of Vidmar's accounts were wiped from the site. And so the vendors that sell the fakes to Vidmar put a little more work into them: The fakes now feature photos, profile details, and tweet a number of times before he buys them; he got 1,000 for $58 from a Pakistan supplier this month. From there, he has the accounts tweet, retweet, follow, and message—all in the name of clients like "Rapper/Singer/Producer/Guitarist/Fitness Model" Dave Murrell aka @Fyrare (number of Twitter followers: 238,360). Murrell has tried Twitter ads, but says he gets more bang for his buck with Vidmar. Murrell doesn't exactly express any qualms: "If you're not padding your numbers, you're not doing it right. It's part of the game." And it's not just follower count that can be affected: Client Tony Benson (aka rapper Philly Chase) says Vidmar's fake accounts pushed him onto the "trending topics" list and eventually sparked the noticed of Philadelphia media. Buying and selling both accounts and followers is, of course, barred by Twitter's terms of service, but Vidmar notes he has never been contacted or threatened with legal action by Twitter.