Real or Imposter? How to Verify That a Bluesky Account Is Legit

As Bluesky’s user base has blown past 25 million accounts, the platform is both losing whatever small-town ambiance it had and starting to feel more like home to X exiles.

But seeing a familiar handle—either one that follows you or that shows up in the username-matching tool Sky Follower Bridge—does not ensure the account is who you think it is. As Bluesky has grown, it has drawn its share of bad actors. And as with bigger social platforms, many of these scammers start by impersonating people you might be inclined to trust.

(Hint: If you get a direct message on Bluesky from a new account with a familiar handle, contact the person behind that username through some other medium. It’s been a long year; they would probably appreciate an email or a text from you.) 

Bluesky doesn’t have a formal verification system like the one Twitter once ran for higher-profile accounts, nor does it have a paid tier like those at X or Facebook and Instagram that might lend a little more status to your account. This public-benefit corporation is working on a subscription option with added features, but the Bluesky+ profile badges it teased this month will have “no relation to verification,” nor will they function like Twitter’s paid checkmarks, if they’re released, says Bluesky software engineer Dan Abramov.

Last month, Bluesky spokeswoman Emily Liu says the company is “thinking through” verification options. In the meantime, it has “quadrupled the size of our moderation team so we can more quickly review and action impersonation accounts.”

The Bluesky Safety team later posted that it “updated our impersonation policy to be more aggressive. Impersonation and handle-squatting accounts will be removed.”

Parody, satire, or fan accounts are allowed on Bluesky, but they must clearly label themselves as such in the display name and the bio. “Accounts with only one of these elements will receive an impersonation label,” it says.

The social network is also going after identity churning, or changing your account identity with the intent to mislead users. “If you set up an impersonation account just to gain followers and switch to a different identity that is no longer impersonation to keep that account, your account will be removed,” the safety team says.

Domain Verification

For now, Bluesky offers a form of self-verification that should appeal to anybody who already has a website that is publicly recognized as their own and has its own domain name. With a few changes in DNS settings at your domain registrar or web host, Bluesky will turn your previous bsky.social handle into that domain name.

(Initially, switching to a domain as your username freed up your first handle, potentially allowing someone else to poach it. But that’s no longer the case after a recent update.)

The domain option both instantly associates your Bluesky self with the web identity you already have and exhibits the core portability of Bluesky’s design: The platform’s open AT Protocol is designed to let you move your entire profile to a different host, and that includes not being tied to Bluesky’s own domain names.

(I did that with my own account, which now has the robpegoraro.com domain I’ve used since 2011; we at PCMag are working on that for our @pcmagofficial.bsky.social account, which I assure you is the real thing.)

With a little more IT-department-level tinkering, you can also turn a Bluesky handle into a subdomain of an established domain name. The most obvious exhibit of this is among members of Congress who have begun setting up official accounts at house.gov or senate.gov domains; for example, Sen. Ron Wyden (D-OR) posts as @wyden.senate.gov. Liu says Bluesky is working with other elected officials to use this option.

If you haven’t registered a domain yet, you can do that through your own Bluesky account via the platform’s partnership with the registrar Namecheap. But bear in mind that if you don’t have that domain pointing to any other web presence, people who see the new domain name as your handle and then type it into their browser will get taken right back to your account. 

Bluesky doesn’t have a running count of self-verified accounts, but a database maintained by a third-party developer lists 64,723 .com handles, plus tens of thousands more under such other top-level domains as .me (as in Montenegro) and .cat (Spain’s Catalonia region, beloved to those of us who travel there for MWC).

Proof From Accounts on Other Services

People who are responding to Elon Musk’s chaotic management of X and that platform’s transformation into his propaganda playground by moving to Bluesky have another option: Use their already-recognized Twitter/X account to announce their Bluesky handle. That could take the form of a tweet with a link to that, a mention of it in their profile, or a change to their displayed name to advertise the Bluesky handle.

All of those things are easy and free to do. Of course, a disturbing number of people either do not avail themselves of any of them or engage in cutesy workarounds like sharing a screengrab of their Bluesky handle, which means that searching their X profiles for “Bluesky” or “sky” will surface nothing. 

Here, I have to offer some advice directly to those X refugees: Yes, X now downranks links, but so what? The point of posting about your Bluesky handle is not to have that bubble to the top of whatever is trending on X these days, it’s to be found by people who went straight to your profile.

If the new Bluesky user you’re curious about experimented with Mastodon, don’t forget to check for a Bluesky announcement post there, too.

Finally, check whatever corner of the web this person can edit—their own blog, their LinkedIn profile, an author page at a site where they write regularly, whatever. Alas, this also seems too hard for many Bluesky users, perhaps because web design templates have yet to catch up. 

For example, Sen. Wyden has been posting on Bluesky since May 2023, but his office’s home page on the Senate site doesn’t mention that. Bluesky links are also absent from the site of Blockchain Capital, the San Francisco venture capital firm that led a $15 million funding round for Bluesky announced in October. 

If They Know, You Know

Your last resort if you’re looking at an account that seems to be from somebody you know of—but don’t know well enough to zap off a quick email or text to confirm the account—should be to see if other Bluesky users have vouched for the account.

The platform’s ingenious starter pack feature—which lets somebody put together a list of accounts that you can follow with one click or tap—can be one such signal. If, that is, the starter pack that includes the account in question came from somebody who’s been around the platform for a while. (PCMag, for example, has a starter pack of our experts.)

You can also check the mystery account’s follower lists to see if people who would be in a position to know the account’s identity are following it. For example, if the new Bluesky account comes from an elected official representing your area, seeing other local electeds following them should be a positive signal.

Older readers may remember this concept as the “web of trust” through which we’d all verify each other’s Pretty Good Privacy encryption keys… which did not scale well at all.  

Labelers, another user-generated filtering option you can add for free from your own account, can also help. Hunter Walker, a reporter for the political news site Talking Points Memo, helped create one that labels accounts of media types, celebrities, and politicians that he’s verified through his own reporting; another one labels confirmed Microsoft employee and “VIP” accounts. Subscribe to either one, and accounts ranked legit will show up with an extra label below their handle.

If none of these methods help you verify an account that looks like somebody you recognize, don’t trust it too much. Read it all you want, but hold off on interacting extensively with this account’s posts, much less amplifying them. At least not until Bluesky adds an edit feature, which you may be relieved to know is on the roadmap for the platform.

About Rob Pegoraro

Contributor

Rob Pegoraro writes about interesting problems and possibilities in computers, gadgets, apps, services, telecom, and other things that beep or blink. He’s covered such developments as the evolution of the cell phone from 1G to 5G, the fall and rise of Apple, Google’s growth from obscure Yahoo rival to verb status, and the transformation of social media from CompuServe forums to Facebook’s billions of users. Pegoraro has met most of the founders of the internet and once received a single-word email reply from Steve Jobs.

Read Rob’s full bio

Read the latest from Rob Pegoraro