Burner Account Detection: How It Actually Works

Burner account detection is really 2 problems wearing 1 name. The first is linking a secondary account to a person, which is an identity problem and mostly solvable. The second is deciding why that account exists, which is a question about intent and not solvable from the outside at all.

Most tools do the first and present it as the second. That is where the trouble starts, because a pseudonymous account kept for safety and one kept for harassment look identical in the data.

Here is what the signals actually tell you, what they cannot, and the question worth asking instead. If you want the background on what these accounts are and why people use them, start with our guide to social media burner accounts.

What signals indicate a secondary account?

They all point at separation: an account built to be hard to connect to a main one.

Only the last row is evidence. Everything above it is a pattern that fits a secondary account and also fits a lot of ordinary accounts, which is the same problem we worked through in fake follower detection: cheap signals are weak signals.

The device and timing row is worth a note. It is the strongest technical signal and platforms do not expose it, so anyone offering it from outside is inferring it from posting times, which is far noisier than it sounds.

Why can none of this show intent?

Because the same account structure serves completely different purposes, and the structure is all you can see.

Consider who keeps a second account. People not publicly out about their sexuality or gender. Abuse survivors avoiding a named account. Journalists and researchers who need distance from a subject. Teachers, clinicians and police separating work from private life. People in recovery communities. Political dissidents. Someone who wants to talk about a health condition without their employer seeing.

That population is much larger than the one using second accounts to cause harm, and the 2 are indistinguishable from their profile metadata. A detector that flags pseudonymity flags all of them.

This produces the exact problem we set out in the screening risk taxonomy. A neutral signal that reliably predicts a protected characteristic is a proxy for it, and the people most likely to need a second account are often the people least safe being identified. Flagging burner accounts as a risk category is not a neutral act.

Which signals are even visible per platform decides what you can do here. The field list is public. See the coverage list

What is the better question?

Not "is this a burner" but "is this account linked to the subject, and was it declared".

That reframing does 3 useful things. It is answerable from evidence rather than inference. It avoids labelling someone's reasons. And in regulated screening it maps onto an obligation that already exists.

Row 3 is the one that resolves most of the difficulty. If a linked account contains a threat, the finding is the threat. The account being pseudonymous is context, not the finding. If a linked account contains nothing reportable, there is nothing to report, regardless of how separate it looks.

Where does declaration change things?

In immigration and other regulated screening, where applicants are required to disclose the handles they used.

US visa applications ask for handles across a 5 year lookback, including accounts since deleted, and an omission can be treated as material misrepresentation. That gives screening something hiring does not have: a denominator. You can state how many declared accounts you located, and a linked account that was not declared is a documented gap rather than a judgement about someone's character.

That is the honest use of this capability, and it is why visa and immigration screening can report completeness in a way employment screening cannot. The declaration creates the obligation. The detector just checks against it.

In hiring there is usually no declaration, so there is no gap to measure and no obligation to check against. Linking a pseudonymous account to a candidate and reporting it, absent any reportable conduct, is reporting that they wanted privacy.

How should a product handle it?

# Report the link and the evidence. Never the label.

finding = {
    "linked_account":      "platform:handle",
    "link_confidence":     0.88,         # from identity resolution
    "link_evidence":       ["bio_cross_reference"],   # be specific
    "declared_by_subject": False,        # only where declarations exist
    "reportable_items":    0,            # the thing that actually matters
}

# Rules that follow:
#   - reportable_items == 0 and no declaration requirement
#       -> this is not a finding. Do not surface it.
#   - reportable_items > 0
#       -> report the CONTENT, with the link confidence attached.
#   - declared_by_subject == False where declaration is required
#       -> report the gap as a fact, not as an inference about motive.
#
# The word "burner" should not appear in the output. It describes
# a motive you did not observe.

The link_evidence field matters more than the confidence score. A reviewer deciding whether to act needs to know the link came from a bio cross-reference rather than from a thin profile and a hunch. Carrying the evidence forward is the same discipline we apply to every finding in how to build a social screening product.

What about accuracy?

Link accuracy is measurable. Burner classification is not.

You can check whether a linked account really belongs to the subject, because subjects can confirm or deny it, and in declaration contexts you have a list to check against, which gives you a real coverage measure.

You cannot measure whether you correctly identified a burner, because there is no label. Nobody holds a list of which accounts were created with intent to misuse, and asking the subject produces an answer you cannot verify either way. Any published accuracy figure for burner detection is measuring agreement with somebody's guess.

Summary

What you can detect is separation: a second account built to be hard to connect to a main one. What you cannot detect is why it exists, and the population using second accounts for privacy and safety is much larger than the one using them to cause harm.

So link accounts, measure your link confidence, and report conduct rather than labels. Where a declaration requirement exists, the gap between declared and found is a fact you can state. Everywhere else, an account with nothing reportable on it is not a finding, however separate it looks.

Want the account linking layer, with confidence scores you can defend? Get a demo