The economics work against them. Creating a UIID requires localized biometrics on real hardware. That makes mass bot networks and throwaway deepfake profiles technically and economically impractical, rather than merely against the rules.
There is no password to steal. Credentials are device-bound and biometric-secured, held on your own hardware. Because identities live on user devices rather than a company server, there is no central credential store for an attacker to breach.
Duplicate identities are actively prevented. The same mechanisms that stop someone minting a second identity in your name are the reason we cannot promise you a new verified UIID if you delete yours.
Badges make impersonation visible. A badge is a verifiable credential on your own identity, not a label a platform granted. Someone can copy your display name; they cannot copy a credential they were never issued.
If it happens anyway: Report it to [email protected] with as much detail as you can — where you saw it, what identity or alias was used, and screenshots.