Rules
Part of Online identity and self-presentation: a practical guide
What goes wrong with online identity and self-presentation
Online identity problems: diagnose takeover, impersonation, context collapse, stale credentials, linked pseudonyms, oversharing, copied work, and failed recovery.
What to take away
- Preserve URLs, timestamps, notices, and screenshots before changing a compromised profile.
- Separate account takeover, impersonation, stale information, and audience mistakes.
- A familiar profile history does not rule out current compromise.
- Correct the narrow supported fact instead of inventing a complete identity story.
- Escalate threats, fraud, stalking, child safety, and regulated identity disputes through suitable channels.
An identity problem can affect account control, public claims, audience access, reputation, or safety. Diagnose which layer failed before choosing a fix.
The owner cannot sign in
Possible causes: forgotten credential, changed recovery information, malware, phishing, unauthorized reset, platform suspension, or device failure.
Check: provider notices, known devices, recovery channels, security alerts, and the official account-recovery page. Do not use a recovery link sent by an unknown account.
The FTC's guide to recovering a hacked social media account lists warning signs such as unrecognized login or password changes and messages the owner did not send. It advises using provider recovery, securing the account, reviewing access, and notifying contacts after recovery.
Stop if: the associated email, phone, financial account, or employer system may also be compromised. Use the relevant incident process.
The profile looks right but sends a strange request
Possible causes: account takeover, cloned profile, spoofed message, compromised contact, or a legitimate but unusual request.
Check: exact handle, profile URL, account age, recent changes, mutual-contact warnings, and an independently known contact channel.
Do not send money, credentials, codes, or confidential files while identity and request remain uncertain.
Two accounts claim the same identity
Possible causes: official and personal accounts, archived account, parody, fan account, impersonation, or a platform migration.
Check: links from the person's established site, official organization directories, dated statements, and platform notices. Do not ask followers to attack the suspected copy.
Preserve evidence and use the platform's impersonation process. If fraud, threats, or trademark and legal questions exist, use qualified help.
A credential is real but out of date
Symptom: a past job, expired license, old award, or completed project is written in present tense.
Fix: state the date and status, correct the biography, and notify affected parties if the outdated claim influenced a decision. A former affiliation can be accurate when labeled as former.
Audiences collide
Symptom: a post intended for friends reaches clients, relatives, students, or a public search audience.
Possible causes: broad default, changed group membership, tagging, screenshot, public reply, or an incorrect account selection.
Response: preserve context, limit further spread where possible, correct misunderstandings, and review audience settings. Do not promise that deletion retrieves every copy. When the collision ran through a group, the member-visibility and archive items deserve the first look.
A pseudonym becomes linked to an offline identity
Possible causes: reused username, shared email, photo metadata, writing patterns, payment details, cross-posted media, mutual contacts, or a breach.
Response: assess immediate safety, remove unnecessary linking clues, secure accounts, and document where disclosure occurred. For stalking, threats, or intimate material, use specialist support and applicable reporting routes.
Changing a handle after exposure does not erase prior copies or databases.
Identity proofing rejects the right person
Possible causes: record mismatch, name change, inaccessible document, image capture problem, expired evidence, data error, or a process that does not fit the population.
NIST's current publication on identity proofing and enrollment sets federal technical requirements and addresses evidence, validation, verification, privacy, and attack resistance. It supports keeping proofing separate from authentication; it does not dictate a social platform's private sign-up policy.
Response: use the service's official exception, redress, or assisted process. Submit only the requested evidence through the verified channel and ask how it is protected and retained.
The wrong person receives credit or blame
Possible causes: shared name, copied work, repost without attribution, parody misunderstood as real, or a screenshot detached from its source.
Check: original URL, timestamp, authorship records, complete thread, account identifier, and edits. Correct the attribution publicly when the error was public. Parody drift is a classic route; the sharing-stance layer is where a joke loses its marker.
A profile reveals more than intended
Symptom: backgrounds show addresses, documents, school names, workplace access, travel, children, or other people's information.
Response: limit access, remove or edit where appropriate, notify affected people, and review similar posts. Treat document numbers, access badges, and security answers as exposed if readable.
Diagnostic table
| Symptom | First check | Avoid assuming | Stop condition |
|---|---|---|---|
| Login failure | Provider recovery and alerts | Impersonation without evidence | Linked email also compromised |
| Strange request | Independent contact channel | Familiar photo proves sender | Money or code requested |
| Duplicate profile | Stable URLs and official links | Newer account is fake | Fraud or threat |
| Stale role | Registry or employer date | Past role is current | Decision relied on it |
| Audience leak | Visibility and reshare path | Deletion removes all copies | Safety exposure |
| Proofing failure | Official redress process | Person is deceptive | Sensitive document request outside channel |
Common questions
Should contacts be warned after account takeover?
Yes, through a trusted channel, especially if the attacker sent links, payment requests, or false information.
Can a profile be authenticated with a video call?
It may add evidence but does not resolve every impersonation or coercion risk. Match assurance to the consequence.
What if a copied profile has no posts?
Preserve the URL and visible details, then use the platform's impersonation route. Lack of posts does not eliminate risk.
Should an exposed pseudonym be deleted immediately?
First assess safety and preserve necessary evidence. Deletion can remove access to records needed for reporting or recovery.
When is legal advice appropriate?
Seek it for material fraud, defamation, stalking, intimate-image abuse, employment disputes, identity-document misuse, or uncertain legal duties.