Guides
Part of Online identity and self-presentation: a practical guide
How to review an online identity before you trust or publish it
Before you trust or publish an online identity, review account control, stated role, credentials and exposed personal data against your actual decision.
What to take away
- Name the decision first. Buying a print, hiring a freelancer and reading a pseudonymous essay need different proof.
- Keep four claims apartaccount control, real-world identity, role, and credential. One does not settle another.
- Verify money, files and access requests through a channel you found yourself, not one the account sent you.
- Strip home address, routine, travel dates and document numbers from any profile that does not need them.
- Write down what you checked, what stayed self-asserted, and the date the result goes stale.
This runs in two directions. You can review your own profile before publishing, or size up someone else before hiring, paying, collaborating or repeating a credential claim. Hiring a creator you already follow blurs roles, and the difference between fan, paid and client connections decides which expectations apply.
It is not a tool for stalking, doxing, discrimination or demanding a legal name where a pseudonym fits. Employment, safeguarding and regulated decisions belong to qualified procedures.
Start with the decision, not the person
Write the action and the smallest amount of proof it needs:
Before [action], I need reasonable evidence that [account or person] controls [relevant identity or role] as of [date].
Buying a small artwork from a stranger may need seller and payment verification. Payroll access needs a formal organizational process. Reading a pseudonymous essay may need nothing about a legal name.
Sort the claims before you chase them
| Claim | Type | Evidence needed | Status |
|---|---|---|---|
| Controls this account | Account continuity | Secure platform or direct-channel check | Unknown |
| Works for named company | Affiliation | Current official directory | Self-asserted |
| Holds a license | Credential | Relevant official registry | Pending |
| Made the displayed work | Authorship | Portfolio history, original records | Partial |
Evidence does not travel between rows. A work email can support affiliation without proving a degree. A government ID can identify a person without proving they run the account.
Claims and Evidence Needed
Claim
- Controls this account
- Secure platform check
- Works for named company
- Current official directory
- Holds a license
- Relevant official registry
- Made the displayed work
- Portfolio history
Evidence needed
- Controls this account
- Unknown
- Works for named company
- Self-asserted
- Holds a license
- Pending
- Made the displayed work
- Partial
Status
- Controls this account
- Works for named company
- Holds a license
- Made the displayed work
Know what "verified" actually covers
NIST's Digital Identity Guidelines separate identity proofing, authentication and federation, and apply risk-based assurance to federal digital services. The concepts clarify a casual review; a social profile is not automatically subject to those federal requirements.
Ask what was checked, when, and which attribute the result covers. "Authenticated" does not mean every line on the profile is true.
Read the account's history
Look at the stable profile URL, creation date if shown, and past names. Also check posting gaps, stated changes, and linked domains. Finally, see who it talks to. Watch for abrupt shifts in language, topic, payment requests or contact channels.
History supports continuity and nothing more. Accounts get sold, shared, compromised and imitated. Old posts also expose personal data, so collect only what the decision needs.
Verify through a source you found yourself
- employer directory for a current role
- licensing board for a regulated credential
- university or publisher record for a degree or publication
- official organization page for an authorized representative
- the creator's own site for portfolio linkage
- the platform's published verification explanation for a badge
Find that channel independently. A convincing profile can link to a lookalike domain it also controls.
Independent Verification Sources
- Employer directory for current role
- Licensing board for regulated credential
- University or publisher record
- Official organization page
- Creator's own site for portfolio
- Platform's verification explanation
Pause on any sensitive request
Money, credentials, confidential files, codes, remote access or manufactured urgency all justify a stop. Reach the person or organization through a number you already had or an official channel you looked up.
Never hand over a one-time code, recovery link, password, full identity document or bank detail because the account knows personal facts about you. Those facts are often public or stolen. The same play runs on people posing as familiar creators, and setting boundaries with creators includes verifying a private approach independently.
Map who can see your own profile
| Audience | Intended access | Main exposure |
|---|---|---|
| Close contacts | Personal updates | Resharing and screenshots |
| Coworkers | Professional context | Personal detail crossing roles |
| Clients | Portfolio and contact | Location and schedule leakage |
| Public search | Selected work | Old or copied context |
| Platforms and services | Account operation | Data collection and account linking |
Home address, routine, private contact data, document numbers, travel timing and security answers come off unless a defined need outweighs the risk. Group memberships leak on their own; the membership and archive items show what a community can expose.
Audience Exposure Map
Audience
- Close contacts
- Personal updates
- Coworkers
- Professional context
- Clients
- Portfolio and contact
- Public search
- Selected work
- Platforms and services
- Account operation
Intended access
- Close contacts
- Resharing and screenshots
- Coworkers
- Personal detail crossing roles
- Clients
- Location and schedule leakage
- Public search
- Old or copied context
- Platforms and services
- Data collection and linking
Main exposure
- Close contacts
- Coworkers
- Clients
- Public search
- Platforms and services
Lock down control
Use a unique password, a second factor or passkey, protected recovery methods, current software and login alerts where the service offers them. CISA's strong password guidance asks for passwords that are long, random and unique to each account, with a password manager doing the remembering. Review active sessions and connected apps.
Lock Down Account Control
- Unique password
- Second factor or passkey
- Protected recovery methods
- Current software
- Login alerts
- Review active sessions and connected apps
Security protects access. It does not correct a false bio. Treat them as separate jobs.
A placeholder stands in for a missing photo. It tells you nothing about whether the account is real, private, new or fake.
Look at the profile the way a stranger does
Sign out, or use the public-preview tool.
Public Profile Review
- Name
- Bio
- Links
- Visible posts
- Tags
- Old photographs
- Location clues
- Contact fields
Fix claims that are outdated or broader than the evidence. Keep records when a correction, legal hold, contract or safety matter requires it. The profile checklist turns the same ground into pass-or-review items you can run on a schedule.
Write a narrow conclusion
As of Nov. 13, the official staff directory supports the stated job title, and a call to the published office number confirmed account control. The degree claim was not checked. Individual posts still need source review.
Set a trigger for the next pass: role change, unusual request, recovery event, badge change, security alert or a fixed date.
Common questions
Should I ask for a photo ID?
Only when a lawful, proportionate process requires it and you can store it securely. A copied ID creates privacy and fraud risk, and it still may not prove who controls the account.
Can a video call prove identity?
It adds context, not proof. Impersonation, coercion, synthetic media and account compromise all survive a call, so scale the check to what the decision costs you.
Is a long account history enough?
No. It supports continuity but cannot rule out a transfer or a compromise. Consequential actions need independent confirmation from a source you found yourself.
When should the review stop?
When you have the assurance the decision needs, or when the account fails a material check. Collecting unrelated private details does not improve a bounded decision.
