Sock puppet

A single operator creates multiple personas and uses them to post, reply, upvote and review as if they were independent people. The purposes include praising the operator's own product, attacking critics, making a fringe view look popular, and evading a ban by returning under a new name. Because a human runs each account, sock puppets can write convincing, varied text that automated filters may miss. This separates them from fully automated accounts, which are covered under bot detection.

Analysts look for behavior and infrastructure links. Signals include accounts created around the same time, overlapping posting hours, shared writing quirks, the same pictures or bios, replies that always support one another, and technical links such as devices or networks when a platform has that data. Platforms have access to signals that outside researchers do not, so public analysis often reports patterns rather than proof.

A hypothetical case: a set of accounts with different names posts glowing reviews of a software vendor and hostile replies to a competitor's customer complaints. The accounts follow each other and use the same unusual phrases. Whether the vendor ordered it, an employee acted alone or an agency did is a separate question that the pattern alone cannot answer.

Sock puppets distort the picture a team uses to judge public opinion, and they create liability when they are working for the organization. A company that discovers an employee or agency using sock puppets for it has a disclosure problem, not only a social media problem. Regulators and platforms treat undisclosed endorsements as deceptive. A clear internal rule against undisclosed personas, applied to agencies as well as staff, is a basic control.

Document the accounts with screenshots, links and dates before reporting them, since they may be deleted. Report them to the platform under its authenticity or manipulation policy, and separate what the evidence shows from what it does not. If the accounts appear to be connected to the organization's own staff or agencies, involve legal counsel and stop the activity first. Public statements should describe what was found and avoid naming a sponsor without solid evidence.

A pseudonym is not a sock puppet. Many people use pseudonyms for privacy and safety, and using one account under a made-up name is not deceptive in the same way. What defines a sock puppet is the use of multiple identities to create a false impression of independence. See also astroturfing for the campaign-level version.