Social media visa risk report

Admits paid freelance work during F-1

“Honestly the best part of my F-1 year was picking up freelance gigs on the side. Paid way better than the campus job lol”

This tweet admits to paid work outside F-1 employment rules. F-1 students are limited to on-campus employment and authorized CPT or OPT roles. Calling out "freelance gigs" as separate from "the campus job" is an explicit admission of unauthorized employment. Under 8 CFR §214.2(f)(9) this is enough on its own to support a status violation, a visa revocation, or an inadmissibility finding at the next filing. It's the single highest-risk item in the report.

Threatening language directed at embassy staff

“If they deny my visa again I swear I'm going to lose it. Someone at that embassy needs to catch these hands fr”

"Catch these hands" is slang for physical violence. The tweet names a specific venue (the embassy) and a specific trigger (a visa denial). That's the exact structure 9 FAM 302.8 flags as a security concern. Arguing later that it was a vent or a joke doesn't help. The question the adjudicator asks is whether the tweet, read cold, looks like evidence of intent. This one does. Delete it before the next filing.

Retweet of a viral anti-administration thread

“RT @[redacted]: Thread 🧵 everything this administration has done to immigrants in the last 90 days, receipts included. 1/37”

The underlying thread is factual and widely shared. On its own it isn't a problem. Your timeline is otherwise dominated by US-critical content, and an officer reading the feed in one sitting will read this retweet as part of that pattern. The specific risk here is mild. We flag it because it adds weight to everything around it.

Old tweet uses a slur as a joke

“[slur, redacted] behavior ngl”

The tweet is from 2018 and the register is ironic. None of that matters for a social-media review. Adjudicators aren't asked to read tone or era. Delete it.

Frustrated rant about a former employer

“My old manager was the most incompetent person I've ever worked with. 3 years of my life wasted at that company. Never again.”

Unflattering but not disqualifying. The tweet doesn't name the employer or the manager. Reads as personal frustration, not defamation. Flagged for awareness. No action recommended. If the applicant feels strongly, delete it. Upside is small.

Generic complaint about scope creep

“whoever invented "just one more small change" deserves a special circle in hell”

Universal engineer humor. No client named. No action.

Caption admits cannabis use in Amsterdam

“Amsterdam was a different vibe 🍃 let's just say the coffee shops lived up to the hype”

Cannabis is tolerated in the Netherlands. US immigration law doesn't care where the use took place. Under INA §212(a)(2)(A)(i)(II), admitting any controlled-substance use, in any country, at any time, is a ground of inadmissibility. The leaf emoji and the "coffee shops" reference aren't subtle. Admitting cannabis use to a consular officer has triggered a lifetime bar under §212(a)(2)(A) in documented cases. Delete the reel.

Spanish comment in a politically flagged group

“El sistema está diseñado para mantenernos abajo. La única salida es la resistencia organizada. ✊”

Translated: "The system is designed to keep us down. The only way out is organized resistance." Two independent fact-checkers have tagged the group as radical-left-adjacent. The Spanish language doesn't lower the risk. Posts in Madrid, Mexico City, Bogotá, and Lima screen in Spanish. "Resistencia" with a raised-fist emoji is the lexical signature the INA §212(a)(3)(B) terror-related screening flow is tuned to catch. Remove the comment from public view. Consider leaving the group.

Mocking imitation of an American accent

“"Oh my gaaawd you guuuys" 🙄🤡 why do they all sound like this”

Archived in a public highlight called "usa" with ten similar clips. On its own it's mild. The highlight turns what would have been an ephemeral story into a permanent public statement. Delete the highlight. The underlying story can stay. This is a tone signal, not a substantive finding.

Beach story with a mildly suggestive caption

“Beach day hits different when you leave the filter off 😏🔥 #nofilter #vacationmode”

Text is mild. The photo is swimwear and most officers won't flag it. Risk is a hair above baseline. Included for completeness.

Tagged in a protest march photo by a friend

“Tagged in a 2021 protest photo (Climate March, [city redacted]). No face visible in the tagged crop.”

Being tagged isn't a statement. The protest was permitted and had no arrests or violence. Flagged so you know it's there. The applicant can untag with one click.

One-emoji reaction on a political post

“💯”

A single emoji on someone else's post. No different from a like. No action.

Describes a multi-year piracy workflow

“just use real-debrid + a good indexer, i've been sailing the high seas for years and never had a single strike from comcast. worth the $3/mo imo”

"Sailing the high seas" is a well-known Reddit euphemism for torrenting. The applicant names the tooling (Real-Debrid, indexers) and brags about evading ISP notices for years. Criminal copyright infringement at that scale is a federal offense under 17 U.S.C. §506, and can be read as a crime involving moral turpitude depending on the adjudicator. A single Reddit comment usually doesn't trigger a criminal bar, but this one is explicit, and the username traces back to the applicant's main email. Delete the comment. Consider burning the throwaway account.

Heavy activity in a cannabis subreddit

“412 comments and 47 posts in r/trees over 3 years. Moderator-tier frequency.”

Membership isn't an admission. 412 comments is not passive membership. Some of them include first-person drug references ("last night I," "when I tried the") that qualify as §212(a)(2)(A)(i)(II) admissions on their own. We flag the subreddit-level pattern instead of each comment. Best option: delete the account. If the applicant wants to keep it, delete the throwaway's linking email and scrub the first-person admissions.

NSFW subreddit activity on the main account

“23 comments across r/gonewild, r/[redacted-nsfw], r/[redacted-nsfw] between 2022 and 2024”

The comments themselves aren't explicit. The subreddit context is, and Reddit publishes all subreddit activity on the public profile. Move the activity to a throwaway account. Deleting the existing comments scrubs most of the exposure, but Reddit retains the username association. There's no per-comment risk; the risk is the pattern visible from the public profile.

Comment about a hangover

“oof i was so hungover on monday i swear i could still taste the tequila through my headache”

Hangover references aren't drug inadmissibility. Alcohol is legal. We flag only when the pattern suggests problem-level use, like DUIs or rehab. This is a standard adult comment. No action.

Subscribed to r/politics and r/PoliticalDiscussion

“Public subscriptions: 57 subreddits. 2 in the US politics cluster.”

Very common. r/politics has more than 6 million subscribers. No action.

LinkedIn title doesn't match the DS-160 draft

“Senior Software Engineer · [Series-B fintech, NYC] · Jul 2022 - Present”

The applicant's DS-160 draft lists "Software Engineer II" for the same employer and dates. LinkedIn says "Senior Software Engineer." Under INA §212(a)(6)(C), a material misrepresentation on a visa application is a permanent bar. Consular officers do cross-reference LinkedIn against the DS-160. This is one of the most common reasons for a 221(g) administrative processing delay. Reconcile the two titles before filing. Either update LinkedIn to match the DS-160, or update the DS-160 draft and make sure HR will confirm the title if contacted.

Team-size claim looks inflated against filings

“Led a team of 30 engineers at [prior employer] (2019-2022), delivering $12M in annual revenue growth through AI-driven solutions.”

Public Delaware corporate filings and Lever/LinkedIn headcount snapshots from the same period put the prior employer's engineering org at 14 people across all functions. A "team of 30" is a stretch. The risk isn't that it's on LinkedIn. It's that a consular officer cross-references it with the DS-160 employment history and notices the mismatch. Soften the language (for example, "cross-functional group of around 30 across engineering, product, and design") or drop the number.

Endorsed by someone later charged with fraud

“Endorsed: Financial Modeling. Endorser was a former colleague who was indicted on SEC fraud charges in Oct 2024.”

You were endorsed. You didn't endorse them. LinkedIn's endorsement graph is public. Removing it is defensible. Leaving it is also defensible, and removal can sometimes read as concealment. Our call: leave it. Be ready to answer if the question comes up.

Sarcastic post about US healthcare

“Love how the US lectures the world about freedom while half their own people can't afford to see a doctor. Land of the free indeed 🙄”

Political speech is protected. That doesn't stop a consular officer from noting strong anti-US sentiment as part of a character assessment. The sarcastic framing and eye-roll emoji turn what could be a policy critique into personal disdain. On its own this is low-impact. We also surfaced three other posts in the same register. The cluster is what moves the needle.

Shared article with sharp anti-government framing

“This is why nobody trusts the government anymore. Shared: "The Surveillance State Is Here and It's Watching Everything You Do"”

Sharing critical journalism is fine. Adding "nobody trusts the government anymore" converts the share into a personal statement. Under EO 14161, that kind of framing feeds into the "attitude toward US institutions" signal. The fix is light. Either drop the personal framing and just share the article, or take down the whole post. The underlying article isn't the problem.

Member of a group with past protest arrests

“Group: "[Redacted] Student Solidarity Network" · 14,200 members · joined 2021”

The group isn't on the 8 USC §1189 list, but two of its protests (2022 and 2023) ended with property damage and arrests. Membership is visible on the applicant's profile. Either leave the group or hide the group list from the profile. If the applicant stays in the group, be ready for questions at the interview and answer honestly about what the group does.

Political meme shared without commentary

“[meme image of US Capitol with superimposed text]”

Widely shared political humor. No weight on its own. Flagged because an automated system might key on the visual; a human analyst wouldn't escalate.

Public playlist with a drug-adjacent name

“Playlist: "smoke sesh vol. 4" · 87 videos · visibility: Public”

The videos themselves are just music. The title reads as an admission and it's public on the applicant's profile. Switch visibility to Unlisted or Private. You keep the playlist, you just get it off your profile.

Comment on a political commentary video

“Finally someone said it. The whole system is rigged for the 1%”

Generic populist sentiment. Low on its own. Adds a tiny amount to the cross-platform anti-US pattern above. No action needed.

Comment on a craft-beer review video

“the nose on that one is unreal, gonna try to find it this weekend”

Craft beer is legal for adults. Not a risk. Appears here because triage casts a wide net on alcohol-adjacent language.

Trending audio carries violent lyrics

“Caption: "when my landlord texts the rent is going up again 😤". Audio: [redacted trending sound, lyrics reference killing.]”

The caption is mild. The audio is the problem. TikTok exposes lyrics through automatic transcription, so consular-side scraping tools will index the lyric text under the applicant's account. Delete the video. This is a mechanical issue (audio attribution), not a judgment about intent.