Digital Disguises, Vol. 3: Building the Persona
Hey Digital Detectives,
I've been coaching a couple of friends through building their first sock puppets recently, which reminded me how much I actually enjoy this part of the work — it's the closest thing to being a real-life master of disguise.
Two of them asked me the same question, days apart: "Okay, but how do I actually build one of these things?" And honestly? I love this question. Building a sock puppet is genuinely one of my favorite parts of this work. It's part strategy, part creativity, and part figuring out exactly how far a given identity actually needs to go.
Before we get into it, let's get clear on the scope.
- Know your authorization. Are you doing this within your job, your case, your legal boundary? Find out before you build anything.
- This isn't legal advice. Laws vary by state and country. I'm sharing what's worked for me, not telling you what's legal where you are.
- Platforms don't love this. Most social platforms prohibit fake accounts in their Terms of Service. That's a risk you take on, knowingly.
- This protects you, too. We talk a lot about protecting the investigation. We don't talk enough about protecting the investigator.
One more thing: there's no single right way to handle the logistics here. Whether you use your own phone number or a burner, how far you separate your research from your real life — that's personal preference, and what follows is what's worked for me. The one thing that isn't negotiable is next.
New here? This builds on Vol. 1 (virtual machines) and Vol. 2 (Sock Puppets 101). Worth reading first if you haven't already.
The Golden Rule: Nothing About You
Before we talk tools or timelines, let's talk about the person you're building.
Different name. Different last name. Different city. Different life. If your sock puppet could accidentally be traced back to you — if it lives where you live, likes what you like, looks like you — you didn't build a disguise. You built a leak.
And never, ever base a puppet on a real, identifiable person. Not a coworker, not a stranger you found online, not anyone. That's not a persona. That's impersonation, and it's a different problem entirely.
For the face: never use someone else's real photo. Lean on AI-generated faces instead — the more realistic, the more believable your whole profile becomes. A blurry, obviously-stolen photo is the fastest way to make your "real" account look fake.
How Much Should You Cook This?
Here's something I don't think gets said enough: not every sock puppet needs the same amount of effort.
I build these differently depending on two questions: how long do I need this identity to last, and what am I actually doing with it. Think of it like a dial, not a switch.
I've got plenty of friends who've made accounts for their dogs — a full profile, photos, the works. It's honestly a good example of the Quick tier in action: an associate account that keeps your real profile at arm's length.
| Tier | Quick | Standard | Deep Cook |
|---|---|---|---|
| Use case | One-off lookup | Regular research | Long-term investigation |
| Backstory | Name, that's it | Job, city, hobby | Full life, believable detail |
| Photo | Optional | AI-generated | AI-generated, carefully matched |
| Almost anything | Established provider | Gmail, full cook cycle | |
| Phone | Personal can work | Burner recommended | Burner, non-negotiable |
The Email Problem
Every single time someone asks me about sock puppets, this is the first real wall they hit: which email do I use? Honest answer: it depends entirely on what you're using it for.
Low-stakes stuff — a form, a Pinterest account, some random newsletter — almost any provider will do. Major social media — Facebook, Instagram, TikTok — is a completely different fight.
A quick, honest rundown of what I've seen:
Gmail — the gold standard, when you can get it. There used to be a window to secure one with just a backup email — no phone required. That window has mostly closed. These days I'm seeing a QR-code flow — scan it, then send a text from your device to confirm. Get a burner phone specifically for this step.
Hotmail / Outlook — success so far creating accounts on smaller platforms without getting flagged. Haven't put it to the test on major social media yet — a promising early field note, not a guarantee.
Yahoo — same story as Gmail these days. Expect to need a phone number to secure one.
ProtonMail — I've actually had success here, but it's needed more cook time than most providers. I'm not sure if that's tied to it being more privacy-focused or just my own timing — give it longer than you think.
Disposable/temp email services — there are plenty of these out there, and they're genuinely useful for low-effort, quick-tier stuff. I wouldn't reach for one to build a social media account or anything you need to hold onto long-term — they're built to expire, and platforms are quick to flag them anyway.
If you've had luck with a provider I haven't mentioned, drop it in the comments.
Treat this as a snapshot, not gospel. Detection methods shift constantly, and staying flexible is part of the job.
The Phone Number Question
This is usually where people stall out. Here's how I actually think about it.
If it's genuinely low-stakes — a one-off account, nothing ongoing — you can get away with using your personal number, if everything else is clean. A phone number alone, with zero corroborating detail, is low-probability to trace. Not zero.
If this is your regular, everyday research tool — get a burner. No exceptions.
A secondary device, if you can swing one, is one of the most underrated tools in this toolkit — it keeps your puppet's digital life physically separate from your real device, and it travels with you. Do what actually fits your workflow.
Masking Your Own Purchases
Privacy.com lets you link your real bank account and generate a virtual card number. They've also rolled out Privacy Everywhere cards now, so it's not just online purchases anymore. Use it to buy yourself a burner phone. Use it for a VoIP number subscription. Use it for anything else related to building your sock puppet.
- Your bank statement won't show what was purchased
- The merchant never sees your real card details
Do your own research before you get one — terms and features change, and you should know exactly what you're signing up for.
Summary
- Never base a puppet on a real person — zero overlap with your real life
- Scale your effort to your actual need: quick, standard, or deep cook
- Email strategy differs wildly depending on your target platform
- Personal number only for truly low-stakes use — burner for everything else
- Secondary devices and payment masking round out the toolkit
Now that your persona actually exists — next time, we bring it to life. Vol. 4 is all about the age-up process: which platform I build first, why that one earns the most patience, and how I use it to open doors into everywhere else.
Catching up on the series? Vol. 1 covers virtual machines, and Vol. 2 covers the sock puppet basics.
What's your go-to email provider for sock puppets lately? Drop it below — I want to know if anyone else is having luck with Proton.
