2-Factor Authorification

🌟 Author’s Note

This issue goes out with thanks to my editor Catherine Matacic at Science News, who helped me form this idea. If it’s a great idea, it’s hers. And if it’s terrible and embarrassing, it’s probably mine. And extra thanks to Caroline Williams, who took her terrible experience and used it to warn the rest of us!

When people think of someone impersonating them, they might think of someone stealing their credit cards, or worse their Social Security number. They might think of tens of thousands of dollars gone, the strange discomfort of knowing someone is out there, using your money, using your identity.

The Scam

But it turns out people are using impersonation in smaller, but no less unsettling ways. One of my colleagues, Caroline Williams (who I’ve met previously at conferences, she does good work, and she graciously endorsed me writing this all out), found that someone was using her name to pitch to her editors, pretending to be her. She’s not the only one who has experienced this, other science journalists are also getting wind of people using their names.

Williams then got notice from another editor, providing evidence of the impersonation. The person pretended to be Williams, offering crappy, half-baked pitches. The impersonator even emailed Williams’ sources, asking them for comment! This person was doing science journalism (if what they did can be called that) in Williams’ name.

Finally, the impersonator succeeded. They got a pitch accepted at Science. They turned in a sloppy first draft, which the editor then kindly hammered into shape. The piece was even published, and the impersonator walked away with the money.

Thankfully, the piece has now been removed. But what is Williams left with? Fear. Fear that her reputation with editors is being ruined by a bad actor. Fear that this person is taking current and future work out from under her nose.

And she’s not the only one I’ve heard of experiencing this. Editors have told me they have received pitches like this before from people impersonating writers they know. Other writers have come forward with evidence this happened to them. (So far, at least, none have tried to use me. Yet.)

Why didn’t editors catch this?

It’s easy to scoff and say “well why didn’t the editors catch this?” “They should have been more careful!” “We all know scams exist they should know better!”

But I can easily see how people got fooled. The name shows up in email, and it’s a name you know! It’s easy to overlook the email address, or assume the writer is using a new one. After all, who doesn’t have at least a few addresses in 2026? Editors get hundreds of emails in a day, they are sometimes even relieved to see one that appears to be from someone they know and trust, or just someone they’ve heard of.

And when the bad pitch and article came in, should they have been more cynical? Maybe. But it’s also possible they were being kind. This is a writer they trust, or maybe someone they were working with for the first time. A writer who maybe was having a bad day. As we all do! I certainly hope if I turn in work that’s not my best (and not all of it CAN be my best) that my editors would grant me that kind of grace.

Editors are busy, they are overwhelmed, and they are human. They are reading things and fixing them and often doing it under deadline, just like writers are. When you’re slamming out a piece with less than 24 hours to go, it’s easy to see why you’d just fix it, just go with it, there’s no time to do anything else.

And for those who continue to scoff. When was the last time you shared or reacted to a video that you thought was totally real…only to learn it was very well done AI? When was the last time you fell for fake news, or opened an email full of praise for your work…only to find it’s AI slop? The scams get better and better, and we cannot keep our guard up all the time.

Why would someone do this? Why science journalism?

Science journalism itself is not a well-known field, and the people I’ve seen impersonated are not famous. But given what I’ve heard from editors, I strongly suspect it’s not limited to science journalism at all. I bet there are loads of scammers out there, impersonating probably more than one writer at a time, slapping out bad pieces and getting the paychecks.

It does seem odd, because journalism, well, it doesn’t pay much. These days, I often get $1 per word at best, to cover the hours I spend reading, studying, reporting, writing, edits, and more. It doesn’t come out to much money.

Or at least, it doesn’t come out to much money here. In other places, that kind of money can go a lot farther. And if you’re doing it at scale, with AI to help you along? The economics begin to make sense.

Why does it matter?

Here is where you might say, “so what, if a person comes in and writes a crap piece, what does it matter?”

Not only did that impersonator steal the piece, a piece Williams herself might well have pitched, their pitches could be hacking away at Williams’ reputation. A freelance science writer’s reputation is what they have to offer. Our clear pitches, clean copy, our well-sourced pieces and our error-free work. These are reputations built up over years, working with editors over and over, earning their trust, and becoming the kind of writers that an editor turns to or thinks of first. Reputations are what earn us our increasingly-paltry incomes.

But enough bad pitches, enough bad stories and that reputation is gone. Earning it back could take years. She has no way of knowing where else this person is pitching, what bridges they are burning.

It’s the sort of thing that gives me a truly sick feeling.

2-Factor authentication Authorification

I hate that we need it, but I worry very much that freelance journalists are going to need something like 2-Factor Authentication, something to identify who they are. I looked into digital signatures. But freelance journalists work with many clients, those clients would have to know what to look for. Many editors are not actually very tech-savvy (sorry, editors, I speak only the truth). It’s not necessarily useful at the scales at which we work.

So here is what I did: I offered my own 2-factor authentication to my editors. I sent all my editors an email, laying out what happened to Williams, I told them which address my communications would come from, and offered a number to call, so they can verify that it is me. I also offered my “tells,” the things I do on all of my pieces that I use to turn in accurate, checkable work, things that make clear my work is mine. I sent it to every editor I’ve worked with in the past year. (It was also a good opportunity to let everyone know that I don’t use AI in my work. Bonus!)

I admit, I felt foolish sending those emails. I’m not at all important enough for this to happen to me (I think). I felt like a Boomer passing on a meme. “I DO NOT GIVE FACEBOOK PERMISSION TO USE MY INFORMATION…SHARE IF YOU AGREE!”

I also have a Google alert set for my own name. When I set it up, it seemed egotistical in the extreme. But it has been useful. As a freelancer, often editors don’t let me know when a piece goes live, the Google alert is the only way I know. In addition, when people have tried to dox me (when people post your address and number and information so that others will harass you, and I hate that I have to define that for people and I hate even more that it exists), the Google alerts have let me know it’s happening, though I have steps in place to protect myself. (If you are a journalist, and you have not already taken steps to protect your personal information…please do that. Please do that right now.) Now, hopefully, if someone else posts under my byline, I will see it immediately.

Maybe someday, if we’re lucky, people will stop doing this, finding it’s not profitable. Maybe if we’re slightly less lucky, we can set up some form of journalist identification or 2-factor system to protect us all. But I wanted to take it seriously now, and not wait til it happens. Much like doxxing, if you wait til it’s happened, you will be too late.

Where have I been?

• Writing about carbs! Yes, they are the current devil-du-jour of the nutrition world. And they don’t deserve it. Carbs are important and they deserve our love.

• I’ve also been writing about sweeteners! What does it take to make something TASTE like sugar? Do they really have no calories?

• I also got to write about how scientists and art historians work together to dig natural history secrets out of beautiful artistic work.

• You might think it’s tools that set us apart from animals. But it’s not. Neither is language. Or social skills. Maybe it’s math? How we think about shapes and numbers? Welp, guess the monkeys proved that one wrong, too.

• Anyone who has gone through menopause can tell you about sleep issues, brain fog, memory issue…but while the brain is changing…it’s not showing up on brain scans! Unlike the gray matter changes in puberty and pregnancy, there’s a pause in brain changes in menopause.

What am I reading?

• Ok listening. The podcast Your Diet Sucks is such fun and well-researched take down of the fad diets, and a defense of eating enough food, for once. Especially if you, like me, spend too much time literally running from your inner demons.

• Wake up babe a new cat just dropped. And you’ll probably get mauled, but you’ll definitely “pspspsps.”

• Freaking out about “rogue AI,” gives the AI the credit and the blame. The reality is? “People are giving AI agents too much reach with too little oversight.”

• Is science journalism dying? This one gave me enough thoughts for an entire extra newsletter entry. The TL;DR for me: Substack is not going to save anyone.

Header image by Sergiu Nista on Unsplash. Hey, Mr. Editor, you wanna buy some….journalism?