What is a sock puppet account?

A sock puppet account, often written sockpuppet, is an extra account run by somebody who already has one and presented as an unrelated person. The purpose is manufactured independence: to agree with oneself in public, vouch for oneself in a review, vote for oneself in a poll, or refer oneself for a bounty. One person, several voices, each presented as independent.

How sock puppets are used

The classic use is reputation. Our impresario posts a question and answers it, leaves a glowing review of a product being sold from another account on the same desk, or enters a dispute with three supporters who all registered that afternoon and write in a strikingly similar style. In every case, the value depends entirely on the audience believing these are separate people. The deception is the product, not a side effect.

The commercial versions are more direct. Manufactured reviews and testimonials move real money, and in the United States they now carry statutory penalties: the FTC's Rule on the Use of Consumer Reviews and Testimonials, effective 21 October 2024, prohibits writing, selling, or buying reviews from accounts that do not represent genuine customers. Referral schemes pay on the assumption that the referred party is a different person, an assumption the enterprising operator is delighted to exploit. Marketplace sellers bid on their own listings. Community platforms discover that an apparent consensus has only one voice behind it.

Why sock puppets are hard to spot

Individually, each sock puppet looks like an ordinary account. It has a plausible name, a working email address, and an unremarkable signup. The deception exists only in the relationship between accounts, so any check examining one registration at a time will miss it. That is why sock puppets survive email verification, CAPTCHA, and most signup-time controls.

How Dregs detects sock puppets

Dregs links accounts through the artifacts an operator has to share: device fingerprints, IP addresses, session characteristics, and behavioral patterns. A cluster connected by several of these signals is much stronger evidence than any one alone. That keeps false positives down where an office or household might otherwise resemble a puppet show.

The linkage feeds the Uniqueness score, and every link opens into the evidence that produced it, so a reviewer can see exactly why two accounts were joined before deciding what to do about the cluster.

Frequently Asked Questions

Q: What is the difference between a sock puppet and an alt account?

A: Deception. An alt account is simply a second account, often for an entirely ordinary reason: separating work from personal use, testing a feature, or keeping a hobby apart from a professional profile. A sock puppet is an alt account that pretends to be somebody else in a context where independence is the whole point, such as vouching for its owner, voting, or reviewing. The account structure is identical; the misrepresentation is what makes it a sock puppet.

Q: How are sock puppet accounts detected?

A: By linking accounts that behave like one operator. Device fingerprinting catches the accounts sharing a browser and machine, session and network analysis catches accounts that are never active at the same moment or always active from the same address, and writing and behavioral similarity catches the ones that share a voice. Any single signal has innocent explanations (families share devices, colleagues share offices) so the reliable approach is to look for several agreeing at once.

Q: Are sock puppet accounts against the rules?

A: On nearly every platform, yes, though the wording varies. Most terms of service prohibit misrepresenting your identity or operating accounts to manipulate votes, reviews, or reputation. Where money is involved, such as manufactured reviews or referral bounties, it may also run into consumer-protection rules on deceptive endorsements.

Detect sock puppet accounts and manufactured activity.

Dregs helps you detect sock puppet accounts manipulating reviews, votes, referrals, or community activity. It connects accounts by device, network, session, and behavior, exposing the single operator behind an apparent crowd.

Schedule a Demo