Tips for Creating Covert Accounts

Tips for Creating Covert Accounts#

Covert accounts are becoming increasingly difficult to create as social media platforms expand their security and authentication checks. There are still some methods that can be used to get around these checks, but different multiple attempts and combinations of techniques may still be required.

Email#

  • Use a provider like Proton Mail that does not require any verification.

  • Use temporary email service like temp-mail.org

Gmail#

Many social media accounts require emails from professional domains or from Gmail, but creating a covert Gmail account sometimes requires further verification.

  • Use another covert email account for verification

  • For educational purposes (MCSI exercises) or for low-stakes investigations, you can simply use your own phone number for verification. Alternatively, you can ask a friend, co-worker, or peer if they wouldn’t mind providing their phone number to verify an account.

Phone Number Verification#

Some covert accounts require verification via phone number. To avoid using your personal phone number, you can try one of the following methods:

  • Use a temporary phone number service like receive-smss.com

  • Use a VOIP like Google voice

  • Purchase a prepaid phone or use an old/unused phone with a prepaid sim card

LinkedIn#

LinkedIn requires emails from professional domains or from Gmail, but you can sometimes use a temporary email service like temp-mail.org. This method should only be used to create a disposable account that will be used for short-term engagements because if further verification is required later, you will not be able to access your account.

Facebook#

Facebook is currently one of the most difficult accounts to create and they seem to employ different checks for each account that is made. It is recommended that you utilize as many of these methods as possible.

General methods

  • Ensure that cookies & history have been cleared, use a different browser from the ones you normally use, or use a private browser.

  • Create the account using a network that is different from your home network.

    • Avoid using a VPN

    • Go to a local coffee shop of library and use their WiFi

  • Use an email address that is at least a few weeks old and has been used for various purposes.

  • Use an email address that has already been used to create other social media accounts. This works especially well if you have an existing covert Instagram account, but be sure to use the same profile information (name, DOB, etc.)

  • Create the account using a mobile device.

    • This works better if you have an old/unused phone. You can purchase an inexpensive prepaid SIM card (e.g. Mint Mobile) for service.

  • Use a profile photo that is of a real person, avoid AI-generated profile pictures.

For learning purposes or very low-stakes investigations

Create another profile for your existing/legitimate Facebook account. It is important to note that this method should only be used for training (like MCSI exercises) or very low-stakes investigations. Do not use this account for investigations that could endanger your privacy (e.g. investigations involving criminals, missing persons, certain political topics, etc.).

Ethically ambiguous method

Use profile information based on a real person. Avoid using someone you know or any high-profile individual. I have had success in the past by looking up arrest records and using the name, birthdate, and photo of an individual who has recently been released from prison. This method should be used in combination with the general methods, and should be used with great caution as it may violate ethical boundaries.

Instagram#

It is relatively easy to create a covert Instagram account, but since it is now owned by Meta, they have begun to implement more security checks, and it may go in the direction of Facebook-level difficulty at some point. The general methods used for creating a covert Facebook account can also be used for Instagram.

Contents