Mira CalderFinding accounts is the easy half. The hard half – the half almost everyone gets wrong – is proving that the accounts you found belong to the same person.
| What you have | Best first move | What would strengthen the match |
|---|---|---|
| Exact rare username | Run an exact username search | Mutual links, the same personal domain or a consistent timeline |
| Full name plus context | Run a social media search with city, workplace or school | Two independent profile details that agree |
| Public email address | Check pages that publish it with reverse email lookup | A self-published profile or domain connection |
| Name only | Build a candidate list; do not merge accounts | Add a second public anchor before concluding |
The stopping rule matters: one matching attribute creates a candidate, not an identity. Conflicting employer, location, timeline or original-photo evidence should stop the match even when the name or profile image looks right.
Start from the strongest identifier you have
Not all starting points are equal. Ranked from most to least useful:
A username. The best possible start. People reuse handles across platforms far more than they realise, and a distinctive handle is close to a unique key. If someone is @marlow_builds on one site, that exact string is worth checking everywhere.
An email address. Strong when its local part resembles a distinctive username or when the address has been published on a profile. Do not probe password-recovery flows or contact discovery features to expose private account connections.
A phone number. Moderate. Useful when it's published on a business profile; much weaker for a personal mobile.
A full name. The weakest, and the one most people start with. "Thabo Molefe" is thousands of people. A name alone is a starting point for a search, never a basis for a conclusion.
Work the username properly
If you have a handle, don't just check it on the obvious three platforms. Check the variations people actually use when their first choice is taken:
- the bare handle –
marlowbuilds - with separators –
marlow_builds,marlow.builds,marlow-builds - with a number –
marlowbuilds1,marlowbuilds02 - truncated, because some platforms cap length –
marlowbuild - with a platform-appropriate prefix or suffix –
marlowbuilds_official,realmarlowbuilds
A hit on an identical rare handle across two platforms is meaningful. A hit on a common handle – mike, photos, admin – is meaningless. Judge the signal by how rare the string is, not by how many platforms it appears on.
Use the link-in-bio trick
This is the single highest-yield technique and it is routinely overlooked.
People link their own accounts together. A Linktree, Beacons, Carrd or about.me page, or just the link field on a profile, frequently lists every account the person wants associated with them. One page, self-declared, no inference required.
Similarly, a personal site's footer, a newsletter's signature block, a conference speaker bio or a GitHub profile's website field will often name several accounts at once. When the person themselves has published the connection, you are not guessing.
Then verify, because this is where people go wrong
Suppose you now have four accounts with the same handle. The temptation is to declare them the same person. Resist it – handle collisions are common, and squatters deliberately register the same name across platforms.
Look for corroboration, which means independent facts agreeing:
- The same rare handle. Weak alone, strong in combination.
- A mutual link. Account A links to B and B links back to A. This is strong self-declared evidence, but compromised or impersonating accounts can still copy links, so corroborate it.
- A shared external identifier. The same personal domain, the same business email, the same phone number listed on both.
- Matching biography details. Same employer, same city, same course of study, same niche. Two accounts both saying "cellist, Johannesburg" is worth more than two accounts both saying "photographer".
- Consistent timeline. An account created in 2015 that describes a job the person didn't start until 2021 needs explaining.
A useful rule: never merge on name alone, and never merge on a single signal. Two or three independent signals that agree, with nothing contradicting them, is a reasonable conclusion. One signal is a hypothesis.
Watch for the things that will fool you
Common names. If the name is common, everything above gets harder and your confidence should drop accordingly.
Parody, fan and tribute accounts. Often use the real person's name, photo and bio. Check for a disclaimer, low follower counts relative to the claimed identity or a creation date long after the person became known.
Old accounts. People abandon profiles. An account that hasn't posted since 2017 may genuinely be theirs and tell you nothing about them now.
Deliberate separation. Many people keep professional and personal accounts apart on purpose, with different names and no links between them. That separation is a choice, and the fact that you could connect them doesn't mean you should act as though they're one public identity.
What you should not do
Some methods are off the table, and it's worth being explicit about why.
Do not attempt to access an account you don't own – that includes password guessing, recovery-flow abuse and anything involving credentials from a data breach. This is unauthorised access, it's illegal in most jurisdictions, and no research purpose justifies it.
Do not use pretexting: creating a fake profile to befriend someone, or impersonating a recruiter or an old classmate to get information they wouldn't otherwise share. If your method requires deceiving the person, you have left research and entered manipulation.
Do not treat inferred connections as facts. "These accounts are probably the same person" is an honest sentence. Publishing that inference as a certainty about a named individual can do real harm if you are wrong, and you will sometimes be wrong.
Where automated tools fit
A tool can run the mechanical part far faster than you can: checking a handle across hundreds of sites, pulling public profile data, spotting mutual links and scoring how well the evidence agrees. That's genuine time saved on a task that is otherwise tedious.
What a tool should not do is hide its reasoning. If it tells you an account belongs to someone, it should show you the public source that supports the claim so you can judge it yourself. A confident answer with no sources behind it is worth less than a hedged answer with five links, because only one of those lets you check the work.
For what it's worth, that's the line we try to hold in our own product: search public sources, show the source for every claim and say "possible match" when that's what the evidence supports.
The limits worth remembering
Public-web research tells you about someone's public footprint. That is not the same as telling you about the person, and it is emphatically not a background check. Information gathered this way isn't assembled to the standard consumer-reporting law requires and must not be used to decide employment, credit, housing, insurance or tenancy.
Use it to orient yourself before a meeting, to check that a contact is real or to reconnect with someone you've lost touch with. Don't use it to build a file on a private individual who has done nothing but exist online.
In South Africa, the Protection of Personal Information Act (POPIA) allows you to object to processing of your personal information by submitting Form 1 to the responsible party, provided you can show legitimate grounds for objection. If you believe your personal information is being processed unlawfully, you may lodge a complaint with the Information Regulator using Form 5 (available online or via email to POPIAComplaints@inforegulator.org.za). Note that the Regulator will not accept complaints where the cause of action arose before 1 July 2021, or complaints lodged more than three years after the claim arose. For general enquiries, contact the Information Regulator toll-free at 0800 017 160 or via email to enquiries@inforegulator.org.za.
Try the lookup with clear expectations
Search for candidate public social profiles by name. Running a search requires paid access; see plans and usage limits. A match is a candidate to verify, not proof of identity. Open the original sources before drawing a conclusion.