Being Harassed Online: How to Investigate It Lawfully in 2026

Being harassed online is exhausting in a way that is hard to explain to anyone who has not lived it: the messages arrive on every device, they know details they should not know, and each new account is a reminder that blocking did not work. The instinct is either to answer back or to delete everything and disappear. Both make it worse. What actually stops it is a record that other people can act on, an understanding of which route can unmask whom, and a clean account and device so the next attempt starts from nothing. This guide is about doing that lawfully, in the order that works.

What separates harassment from cyberstalking

Harassment is conduct. Stalking is a pattern of conduct that causes fear, and most legal definitions require both repetition and a reasonable person fearing for their safety. One rude message is not stalking; a hundred messages from six accounts, a mention of your street, and a photo of your car is. The distinction matters because it decides which route has power: a platform can remove content and ban accounts, a court can order someone to stop, and police can investigate a crime. None of them can do the others' job.

Three categories are worth naming at the start, because they change what you do in the first hour:

• Threats to physical safety. Anything naming your location, your family, your workplace or a weapon. This is a police matter first and an evidence exercise second.
• Doxxing and intimate-image threats. Publishing or threatening to publish your address, documents or images. Most jurisdictions treat the threat itself as an offence, and platforms remove it fastest through their dedicated intimate-image channels.
• Sustained abuse without a stated threat. The hardest to act on, and the category where a documented pattern is what eventually converts into a protective order.

If there is immediate danger, the online investigation can wait. Call local emergency services, then preserve what you have; evidence does not expire in an hour, and a safety decision made badly can.

The first hour: what not to do

Four actions feel like progress and destroy the case:

1. Do not answer back. A reply confirms the account is read, gives them a reaction to work with, and often escalates. If you have never told them to stop, send one short written message stating that contact is unwanted and not to contact you again, then stop. One message, no argument, kept as evidence.
2. Do not delete the messages or the account. Deleted content is gone from your side, and a platform report against a deleted thread has nothing to review. Archive instead.
3. Do not confront or investigate them in person. Turning up at an address you found is how a victim becomes a defendant.
4. Do not let a friend "sort it out". A group of friends messaging the harasser contaminates the record and can be read as coordinated harassment in the other direction.

What you should do in that hour is smaller and less satisfying: capture everything once, change nothing else yet, and write down the first date you noticed the behaviour. That date anchors the pattern.

Building an evidence record that survives scrutiny

Police, lawyers and platform trust-and-safety teams all work from the same thing: a chronology they can verify. A folder of cropped screenshots with no context is close to useless, because anyone can make one. The record below is the one that gets acted on.

Two technical details are worth knowing. Email headers carry the routing information that lets an investigator see which provider a message actually came from, so keep the original. And a screenshot taken on a phone that shows the harasser's profile is more credible when the same capture shows the date, which is why full-screen beats cropped every time.

The identity question: what can lawfully be established, and by whom

Almost everyone asking for help with online harassment is really asking one question: who is this. The honest answer is that attribution comes from three routes, and only one of them is open to you as a private individual.

What is not on that list, and never becomes lawful because the other person started it: breaking into their accounts, installing anything on their devices, bribing a platform employee, or paying someone who offers to "hack them back". Every one of those turns you into the person committing an offence, and it also destroys the credibility of the record you built. If someone tells you they can get the identity in 48 hours for a few hundred dollars, they are describing a crime and taking your money.

Open-source work you can legitimately do yourself

Before paying anyone, a careful hour of public-source review answers a surprising amount, and everything below uses only what the person published themselves.

• Username reuse. The same handle on a forum, a marketplace and an old photo account usually means the same person, and the older accounts carry more identifying detail than the throwaway ones.
• Account age and history. A newer account that reproduces details from an older one suggests one operator. Note both IDs, because ban-evasion reports need the pairs.
• Writing fingerprints. Vocabulary, recurring typos, punctuation habits, and the specific things they know about you. Investigators use these to link accounts; so do courts, when the pattern is consistent.
• Time zone signals. When the messages arrive across weeks, the active hours narrow down where the person is.
• Public registration records. If a domain or website is involved, its public registration data may name a registrant, and archive snapshots may show what it said before it was cleaned up.
• Image reuse. A reverse image search on an avatar tells you whether the profile photo was stolen, which by itself is evidence of a fake account.

Keep the same discipline as with the abuse record: capture the URL, the timestamp and the account handle, and note how you found it. An investigator's notes are evidence; a memory is not. And stay inside public sources. Requesting a password reset to see a masked email address, or using a data-broker lookup to obtain a home address, is exactly the behaviour you are complaining about.

When it is someone you know: devices, accounts and shared access

The most common cyberstalking case is not a stranger. It is a former partner, a colleague, a neighbour, or someone in the family, and the reason they can reach you is usually access they were given and never revoked: a shared cloud account, a family plan, a password they watched you type, a tracking device in a bag or a car, or software installed while they had physical access.

Work through the access list rather than the apps:

1. Shared cloud and family plans. Photos, location history, and backups all sync through them. Remove the other person from the family group and change the account password from a device they have never touched.
2. Device access. A phone that was briefly in their hands can carry a profile, a management certificate or a tracking app. On iPhone check Settings for profiles and device management; on Android check for device-admin apps and accessibility services you did not enable. If anything looks wrong, back up your data and reset the device.
3. Physical trackers. Small Bluetooth tags and hard-wired vehicle units are common. If you find one, photograph it in place before removing it, and give it to police rather than to a friend.
4. Account recovery settings. The recovery email and phone number are how someone gets back in after a password change. Check them on every account that matters, and remove anything you do not recognise.
5. Sessions and connected apps. Sign out of all devices, then revoke third-party apps you did not authorise. A connected app can keep reading mail or messages after a password change.

If there is any reason to think the device itself is compromised, the clean answer is a full reset and a fresh setup from a new email address, with a password manager and an authenticator app. It costs an evening and removes a whole class of problem.

Work hardening: making the next account pointless

Blocking one account at a time is a losing game if the person can create another in two minutes. The goal is not to be unreachable; it is to make you expensive to find again.

• Split your identities. A public-facing account for work or interests, and private accounts under a handle that is not connected to your name, your photo or your usual username.
• Close the discovery routes. Turn off "find me by phone number" and "find me by email" on messaging apps, restrict who can see your friends list, and stop location tagging on photos.
• Check what is already public. Search your own name and each username, then request removal where a data broker or an old forum is publishing your address or phone number. Removal requests are routine and usually free.
• Change the pattern, not just the password. A new email address that shares your name, birthday and old handle is easy to find again.
• Tell the people around you. A short message to your workplace reception, your child's school and two neighbours, with one photo of the person if you have it, prevents the pretext call that gets your schedule read out over the phone.

None of this is surrender. It is the difference between a person who can be found in ten minutes and one who cannot be found at all, and it is usually the change that ends the campaign.

The platform layer: what a report can and cannot do

Platforms can remove content, suspend accounts and, for serious cases, preserve data for law enforcement. They cannot tell you who is behind an account, and they will not confirm what action they took. Filed well, a report does two useful things: it removes the content other people can see, and it creates a dated record with the platform that a later legal request can build on.

• Report the conduct, not the person. Pick the category that matches: harassment, threats, intimate images, impersonation, or ban evasion. A report filed as "I do not like this person" is closed automatically.
• Attach the record. Screenshots with URLs and timestamps, the account IDs, and a three-sentence summary: what started it, how often, and what specifically frightened you.
• Report the new accounts as ban evasion, naming the original account. This is the one report type that connects accounts, and it is the reason account IDs matter more than display names.
• Escalate outside the platform where a regulator exists for this: national e-safety bodies, telecoms regulators and cybercrime reporting portals can require a platform to respond, and they keep their own record.

Expect silence, then partial action. A suspension you never hear about is a success. What you must not do is delete your evidence because a report was filed; the platform's copy is not yours to rely on.

The police layer: what makes a report actionable

Two reports of the same behaviour get different outcomes because of how they are written. The one that gets investigated names a pattern, quantifies it, and points at the specific conduct that meets a legal definition in that jurisdiction.

Ask two specific things: that the platform data be preserved before it ages out, and what a protective order requires locally. Preservation requests are the single most time-sensitive step, because platforms rotate logs and a case that takes three months to reach a prosecutor may already be unprovable. Get the report number, and keep it with the evidence file.

The civil route, and what it costs

Where police will not act, a lawyer sometimes can, because a civil claim has its own disclosure mechanism: once a case is filed, the court can order a platform to produce subscriber information for the account. That is how anonymous harassers are usually unmasked in practice, and it is slow.

Plan for months rather than weeks, and for cost that starts with a consultation and a letter, not a trial. The realistic sequence is: a lawyer reviews the evidence, sends a preservation and cease letter, files if the conduct continues, and requests disclosure. Outcomes vary by jurisdiction, and a claim that is filed badly can expose you to a costs order or an anti-SLAPP motion, which is why this step is worth doing with advice rather than enthusiasm. What a lawyer will need from you is exactly the record described above, in chronological order, with original files.

What a lawful investigator adds, and how the paid-help market goes wrong

An investigator is worth paying for three things a victim cannot do alone: time, tooling, and a report written in the language that a platform or a court accepts. What an investigator legally can do is public-source research, evidence organisation to a forensic standard, platform escalation through the proper channels, and coordination with your lawyer. What they cannot do is anything that requires access to the other person's accounts, devices or data, and any engagement that promises that is not an investigation.

Because the people who need this are frightened and in a hurry, it attracts the wrong kind of seller. Five tells:

• A guaranteed name within days. Attribution through legal process takes longer than the sale pitch allows, and open-source work produces a probable identity, not a confirmed one.
• A price that only goes up. A deposit, then a "platform fee", then a "legal fee" for a lawyer you cannot verify.
• Requests for your credentials. Nobody needs your password or a live two-factor code to investigate your harassment. Credential requests are how a second intrusion starts.
• An offer to hack, dox or confront. All three are crimes, and the person offering will not be the one charged.
• No scope, no contract, no report format. A real engagement states what will be delivered, in what format, and what happens if attribution is not possible.

A legitimate engagement starts with written authorisation from you, names the scope, and describes the deliverable as an evidence bundle plus a written report you can hand to a lawyer or to police. It should also tell you, honestly, when the answer is that attribution is not possible from public sources.

Recovering your own account and device after the harassment

Harassment often arrives with an intrusion attached: a compromised email, a social account someone still has a session on, or a phone that has something installed. The order mirrors the intrusion rather than the harassment, and it is worth doing in full, because a half-cleaned account is how the campaign restarts.

1. Secure the mailbox first. It is the reset route for everything else. New password from a clean device, two-factor on, forwarding rules and recovery addresses checked.
2. Then the accounts. Change passwords, end all sessions, revoke unknown connected apps, and check that no additional recovery method was added.
3. Then the device. Back up what you need, reset, restore only documents and photos, and reinstall apps from the store rather than from a backup that could carry the problem back.
4. Then the network. Change the router admin password, check the connected-device list, and replace the Wi-Fi password if anyone with access to it is involved.

Keep a note of what changed and when. If the person later claims you are the one who escalated, a dated record of defensive changes is a quiet and effective answer.

Frequently asked questions

Can I find out who is behind an anonymous account?

Sometimes, and only through three routes: public-source research that links the account to a real identity, a platform disclosure to law enforcement, or a court order in a civil case. No private individual or investigator can force a platform to reveal subscriber data directly. Anyone promising an identity in days for a fee is selling something that does not exist.

Should I delete the messages and the accounts?

No. Archive them instead. Deleting removes the material a platform report and a police report would review, and it is the single most common way a strong case becomes unwinnable. Keep originals, make copies for each report, and store them where the harasser cannot reach.

Is it illegal to look up public information about the person harassing me?

Public-source research is lawful in most jurisdictions: reading what someone published, checking username reuse, and viewing public registration records. It stops being lawful when it involves accessing accounts, obtaining non-public data, or using it to intimidate. Document what you find and who you found it from, and let a professional or a lawyer take the next step.

Will a platform tell me who reported me or who the account belongs to?

No. Platforms do not disclose account ownership or reporter identity to other users, including victims. What they can do is remove content, suspend accounts, and preserve data for law enforcement. Those actions are worth pursuing, but they will not produce a name.

What if the harassment is from someone in another country?

Report locally first: your national cybercrime portal and the platform. Cross-border cases are handled through mutual legal assistance, which is slow, so preservation requests matter more, not less. If the conduct breaks a platform's rules, the platform route works regardless of borders, and it is usually the fastest relief available.

The short version

Stop responding, capture everything once with the URL and the clock in frame, keep the accounts and the messages, and write a chronology with dates. Then use the three levers in order of what they can actually deliver: platform reports for removal and record, police for preservation and protection, and a lawyer for disclosure. Harden the accounts and the device so the next account they make reaches nothing. Pay for time and evidence quality if you need to, never for access, and never for a name someone promises by Friday.