Who Is Behind an Anonymous Account? How Investigators Identify Online Harassers and Scammers

Updated 5 October 2026 by Investigation Bureau

An anonymous account that is harassing you, impersonating you, defaming your business or running a scam can feel untouchable. Usually it is not. Most anonymous accounts are run by someone who was careless somewhere, and lawful attribution is the discipline of finding where. This guide explains what to preserve before you do anything else, how investigators identify the people behind accounts without breaking the law, when the police will act, how a court can make a platform hand over what it knows, and the cases where the honest answer is that attribution is not possible.

One rule comes before all the others: do not engage. If you reply, threaten, or announce that you are "getting an investigator", the account changes its behaviour, the operator is warned, and the evidence tends to be deleted. Preserve first. Act second.

Preserve first, because it disappears

Capture everything with its context. Take screenshots that show the URL, the account name, the date and time, and the surrounding conversation. A screenshot of a message with no URL is a picture, not evidence.
Record the account's permanent identifier. On most platforms the numeric user ID survives a change of username, and the username does not. An investigator can pull it from the page. If you can find it, write it down.
Keep the originals. Do not delete the conversation, block the account before you have captured it, or edit anything. Files the account sent you (documents, images, voice notes) may carry metadata, so keep the originals and not forwarded copies.
Report to the platform once you have captured everything. A report can lead to removal, which is why capture comes first.
Note payment details if money was involved. Account names, sort codes, PayPal handles and cryptocurrency addresses identify people far more reliably than usernames do.

How lawful attribution works

People reuse things. A username first chosen at fifteen turns up on a gaming forum, a marketplace and a dating profile. A profile photograph shows a real person and can be found by reverse image search. Sometimes it is the operator's own picture, and sometimes it belongs to a victim of image theft, which is a lead in itself. The phone numbers and email addresses used to register accounts link those accounts across platforms. Writing habits, spelling, the times of day at which posts appear (and the time zone they suggest) and the small facts an operator lets slip over months all narrow the field. A scam site's domain registration, hosting and payment arrangements connect it to other sites and other names. The name on a bank account is a real name. Cryptocurrency moves on a public ledger.

None of this requires access to anything private. It is open-source intelligence, applied with patience and cross-checked until the threads converge on a person, or until it is plain that they will not. We run it on our in-house OSINT tooling and not in a browser tab. Identity sweeps across a wide set of platforms, analysis of email addresses, phone numbers and domains, extraction of image metadata and prepared searches therefore take minutes, and every query is logged to the case for the day the evidence is challenged. Our OSINT investigations page describes the capability, and our cyber investigations page describes the cases it is used on.

What cannot lawfully be done, and why it matters to you

We do not access accounts, devices or email without authority. That is an offence under the Computer Misuse Act 1990. We do not obtain personal data by deception, which is an offence under the Data Protection Act 2018. We do not create fake profiles to befriend a subject and read private content, we do not send deceptive links to harvest someone's IP address, and we do not buy data from breaches. Anyone who offers any of these is offering to commit offences on your behalf. What they produced would be inadmissible and would expose you. The purpose of attribution is a name you can act on, in court or with the police, and only lawfully obtained evidence gives you that.

When the police will act

Online harassment is a crime. Depending on the conduct, it may be an offence under the Protection from Harassment Act 1997, the Malicious Communications Act 1988 or the Communications Act 2003, or one of the newer offences in the Online Safety Act 2023, which cover threatening communications, knowingly false communications and the sharing of intimate images. Sextortion is blackmail under the Theft Act 1968. In a criminal investigation the police can require a platform to disclose account data. No private investigator has that power. What an investigator can supply is a well-prepared evidence pack, and that is what turns a report that stalls into one that is acted on. We work alongside a police report, never in place of one.

When a court can force disclosure

Where the harm is civil (defamation of a business, harassment the police are slow to act on, or fraud), the route to a platform's records is a Norwich Pharmacal order. This is a court order that compels a third party mixed up in wrongdoing, such as a social media platform, to disclose what it holds about the account. Typically that means the registration email, the phone number and the IP logs. The application is made through a solicitor. It requires a good arguable case that a wrong has been done and that disclosure is necessary. It also costs real money, so it is used when the stakes justify it. The disclosed data then has to be interpreted, and a second order against an internet provider is often needed to turn an IP address into a subscriber. An investigator's report is what makes the application credible, and what makes the disclosed data useful.

The honest limits

Some accounts are run by careful people: new devices, no reused identifiers, a VPN, nothing personal ever said. An account like that may be impossible to attribute by lawful means. We say so early, and do not bill you to find it out slowly. An IP address does not identify a person when taken alone, and a VPN address identifies nobody. What can nearly always be established is whether an account belongs to a network, whether it is operated from the UK, whether it is connected to a known scam, and what your realistic options are. Sometimes that answer is enough to end the harassment. Sometimes it is the start of a police or court process that does.

What you receive

You receive a written report. It separates what was established from what was inferred, cites the source of each finding, preserves timestamped captures, describes the method plainly enough for a court to follow and states the level of confidence. Attribution work is mostly desk-based, and we quote it as a fixed price after a free, confidential first conversation, so you know the cost before any work begins. Where money has been lost, our guide to romance scam recovery and our illustrative romance scam case story show how attribution and recovery fit together.

Frequently asked questions

Can a private investigator find out who is behind a fake Instagram or Facebook account?

Often, yes, by lawful attribution: reused usernames, recycled photographs, linked phone numbers and email addresses, writing habits, timing patterns and, in scams, payment details. A careless account can be attributed quickly. A careful one may need a court order against the platform, and some cannot lawfully be attributed at all. A good investigator tells you which at the start.

Can the police find out who is behind an anonymous account?

Yes, where the conduct is criminal, because the police can require platforms to disclose account data. In practice they act faster, and more often, when a report arrives with preserved evidence and a clear account of the offence. That is where an investigator's report helps.

Can you trace an IP address to a person?

Not from the address alone. An IP address identifies a connection at a moment in time, not a person. The record of who was using it is held by the internet provider, which will disclose the subscriber only under a court order or to the police. Investigators treat IP data as one thread among several and never as an answer in itself.

Is it illegal to run an anonymous account?

No. Being anonymous online is lawful. What is unlawful is what some anonymous accounts do: harassment, threats, malicious communications, blackmail, defamation and fraud. Attribution is aimed at the conduct, not the anonymity.

How do I get a Norwich Pharmacal order?

Through a solicitor. The application asks a court to order a platform or provider to disclose what it holds about an account. It needs a good arguable case of wrongdoing and evidence that the disclosure is necessary. An investigator's evidence pack is usually the foundation of the application.

How long does it take to identify who is behind an account?

Desk-based attribution usually takes days. Cases that need a court order against a platform take weeks to months, and the court timetable sets the pace, not the investigation.

Being targeted by someone you cannot see. Tell an investigator about it in confidence. The first conversation is free and without obligation, and we will be honest about whether attribution is realistic: start a confidential enquiry.