How to review an online identity before you trust or publish it

What to take away

• Start with the decision and consequence, not a demand to uncover everything about a person.
• Separate account continuity, real-world identity, role, credential, and content accuracy.
• Verify sensitive requests through a channel found independently.
• Minimize personal details that do not serve the profile's purpose.
• Record what was checked, what remains self-asserted, and when the result expires.

This process works in two directions. You can review your own public profile before publishing it, or assess another account before hiring, paying, collaborating, granting access, or repeating a credential claim. Hiring a creator you already follow mixes roles; the comparison of fan, paid, and client connections explains which expectations belong to which.

Do not use it to stalk, dox, discriminate, bypass privacy settings, or demand civil identity where a pseudonym is appropriate. Legal, employment, safeguarding, or regulated decisions need qualified procedures.

Step 1: state the decision

Write the action and the minimum identity assurance it requires:

Before [action], I need reasonable evidence that [account or person] controls [relevant identity or role] as of [date].

Buying a small artwork may require seller and payment verification. Granting payroll access requires a formal organizational process. Reading a pseudonymous essay may require no legal-name proof at all.

Step 2: map the claims

Build a claim table:

Claim	Type	Evidence needed	Current status
Controls this account	Account continuity	Secure platform or direct-channel check	Unknown
Works for named company	Affiliation	Current official directory or confirmation	Self-asserted
Holds a license	Credential	Relevant official registry	Pending
Made displayed work	Authorship	Portfolio history and original records	Partial

Do not use one piece of evidence for unrelated claims. A work email may support affiliation without proving a degree. A government ID may identify a person without proving account control.

Step 3: understand assurance boundaries

NIST's current Digital Identity Guidelines separate identity proofing, authentication, and federation and apply risk-based assurance to federal digital services. The concepts help clarify an online review, but a casual social profile is not automatically subject to those federal technical requirements.

Ask what the service or organization checked, when it checked it, and which attribute the result covers. Avoid translating "authenticated" into "all profile details are true."

Step 4: inspect the account history

Review the stable profile URL, creation date if available, past names, posting continuity, stated changes, linked domains, and interaction history. Look for abrupt shifts in language, topic, payment requests, or contact channels.

History can support continuity but is not conclusive. Accounts can be sold, shared, compromised, or carefully imitated. Old posts can also expose personal data, so do not collect more than the decision needs.

Step 5: verify through primary channels

Use the relevant official source:

• employer directory for current role
• licensing board for regulated credential
• university or publisher record for a degree or publication
• official organization page for an authorized representative
• creator's established site for portfolio linkage
• platform's documented verification explanation for a badge

Find the channel independently. A convincing profile can link to a lookalike domain that it also controls.

Step 6: test a sensitive request

If an account asks for money, credentials, confidential files, codes, remote access, or urgent secrecy, pause. Contact the person or organization through a previously known number or an independently found official channel.

Do not share a one-time code, recovery link, password, full identity document, or financial detail merely because the account knows personal facts. Those facts may be public or stolen. An account posing as a familiar creator runs the same play; boundary-setting around creators includes verifying any private approach independently.

Step 7: review your own audience map

For a profile you control, list expected and plausible audiences:

Audience	Intended access	Main exposure
Close contacts	Personal updates	Resharing and screenshots
Coworkers	Professional context	Personal detail crossing roles
Clients	Portfolio and contact	Location and schedule leakage
Public search	Selected work	Old or copied context
Platforms and services	Account operation	Data collection and account linking

Remove home address, routine, private contact data, document numbers, travel timing, and security answers unless a defined need outweighs the risk. Community memberships deserve a row of their own; the membership and archive items show what a group can leak.

Step 8: secure control

Use a unique password, a suitable second factor or passkey, protected recovery methods, current software, and login alerts where available. CISA's strong password guidance calls for passwords that are long, random, and unique to each account, with a password manager doing the remembering. Review active sessions and connected applications.

Authentication protects account access; it does not correct false public information. Treat security and profile accuracy as separate workstreams.

Photo and credit

A generic placeholder represents an absent profile photograph. It says nothing about whether an account is authentic, private, new, or deceptive.

Step 9: test the public view

Sign out or use the service's public-preview tool. Check name, biography, links, visible posts, tags, old photographs, location clues, contact fields, and search snippets. Ask a trusted reviewer what identity and role they infer.

Correct claims that are outdated or broader than the evidence. Preserve records when a correction, legal hold, contract, or safety matter requires them. The profile checklist covers the same ground as pass-or-review items, useful on a recurring schedule.

Step 10: document the result

Use a narrow conclusion:

As of Nov. 13, the official staff directory supports the stated job title, and a call to the published office number confirmed account control. The degree claim was not checked. Individual posts still require source review.

Set a review trigger: role change, unusual request, recovery event, badge change, security alert, or a set date.

Common questions

Should I ask for a photo ID?

Only when a lawful, proportionate process requires it and secure handling exists. A copied ID creates privacy and fraud risk and may not prove account control.

Can video chat prove identity?

It can add context but is not conclusive. Impersonation, coercion, synthetic media, and account compromise still require risk-based checks.

Is a long account history enough?

No. It supports continuity but cannot rule out transfer or compromise. Use independent confirmation for consequential actions.

How should a creator disclose a stage name?

State the name used for the work and disclose legal identity only when required by the transaction, contract, law, or chosen public context.

What if an employer directory is outdated?

Use the official contact channel and record the uncertainty. Do not treat an old page as current proof.

When should the review stop?

Stop when the needed assurance is reached or the account fails a material check. Collecting unrelated private details does not improve a bounded decision.