Abstract: A system for identifying attacks against a customer in a social network includes a conversation monitor, a user type detector and an attack identifier. The conversation monitor discovers a plurality of users participating in a discourse related to the customer. The user type detector identifies the type of each user that can be real or fake and the attack identifier identifies an attack according to the type of the users. A method for identifying a fake user in a social network includes evaluating an authenticity of a user by applying a set of tests, each test in the set includes one or more rules on one or more parameters associated with the user, each test creating a weighted score. The method also includes calculating a weighted average score from the weighted scores and determining if a user is fake according to the weighted average score compared to a configured threshold.