Cyberstalking Signs and How to Protect Yourself Online

The most common signs of cyberstalking are repeated unwanted contact after you've asked it to stop, evidence that someone is tracking your location or reading messages you never made public, threats to your safety or reputation, and impersonation through fake profiles or hijacked accounts. On their own, none of these prove a crime. Tracked together over time, they establish what courts call a "course of conduct," the legal threshold that separates a single bad interaction from criminal stalking.

Cyberstalking is a federal felony under 18 U.S.C. § 2261A and is illegal under the laws of all 50 states, though penalties vary by jurisdiction. The U.S. Department of Justice's Office on Violence Against Women defines stalking as repeated conduct directed at a specific person that would cause a reasonable person to fear for their safety or suffer substantial emotional distress, and notes that cyberstalking frequently precedes or accompanies physical stalking. According to the Pew Research Center's 2021 State of Online Harassment survey, 41% of U.S. adults have personally experienced some form of online harassment, and cyberstalking sits at the most severe end of that spectrum: sustained, targeted conduct rather than an isolated incident.

This guide walks through the warning signs, the technical methods perpetrators use to monitor targets, and a practical plan for securing your accounts, documenting evidence, and reporting the behavior.

Warning Signs You May Be a Cyberstalking Target

Cyberstalking usually starts with behavior that feels coincidental or just excessive before it escalates into something harder to dismiss. Because the legal standard is a course of conduct, the accumulation of these behaviors matters more than any single incident.

Unwanted, Repeated Digital Contact

A high volume of unsolicited messages across email, text, social media, or messaging apps, especially after you've asked the contact to stop, is one of the clearest warning signs. A single unwanted message is not stalking. Dozens of messages across multiple platforms, or a new account contacting you the moment you block the last one, is the kind of persistence most state statutes require.

Evidence Someone Is Monitoring Your Location or Activity

If someone repeatedly turns up at places you haven't publicly announced, or references private details you never shared with them, they may be tracking your digital activity. Common methods include reading GPS coordinates embedded in photos (EXIF metadata), watching check-ins and tagged posts in real time, using shared-location features in apps like Find My, Google Maps, or Life360 that were granted access and never revoked, or tracking software installed on a device they once had physical access to. References to conversations you never made public are a strong sign that someone has unauthorized access to an account or device.

Threatening or Escalating Communication

Any message that threatens your physical safety, livelihood, family, or reputation crosses from harassment into a criminal offense in most states. Threats don't have to be explicit. A reference to knowing your daily schedule or where you park can qualify depending on your state's law. Save every threatening message verbatim, with the timestamp and platform visible.

Identity Impersonation or Account Manipulation

Cyberstalkers sometimes create fake profiles using your name, photos, or personal details, or attempt to take over your real accounts through password-reset abuse or targeted phishing. Unexpected password-reset emails, login alerts you didn't trigger, or colleagues reporting odd messages "from you" are serious signs that warrant an immediate account security review.

How Cyberstalkers Monitor Their Targets

Most cyberstalkers combine several monitoring methods at once, which is why fixing one vulnerability rarely solves the problem by itself.

Stalkerware and Spyware

Stalkerware is software installed directly on a victim's device, often disguised as a parental-monitoring or productivity app. Once installed it can record calls, texts, and keystrokes, access the camera and microphone, and transmit GPS location in real time, usually without any visible icon or notification. Installation typically requires brief physical access to the phone or computer, which is one reason intimate partners and former partners appear disproportionately in cyberstalking cases.

Social Media and EXIF Metadata

Public social media posts can reveal your routine, workplace, and frequently visited locations. Photos taken on a smartphone often carry embedded EXIF metadata, including precise GPS coordinates and a timestamp, that anyone who downloads the image can extract if the platform doesn't strip it first. Most major platforms strip EXIF data on upload, but this varies by platform and sharing method, so device-level geotagging controls are the more reliable protection.

Account Takeover and Credential Attacks

Some perpetrators go after your email or social accounts directly, through phishing emails, security questions answered using details pulled from public records, or password resets requested through a phone number they already have. A compromised email account hands a stalker your private messages, contacts, and every service linked to that address. Our guide to building consistent cyber hygiene habits covers the account practices that make this kind of takeover harder before a threat ever appears.

Data Broker and Public Records Exposure

Data broker sites aggregate public records including your address, phone number, relatives' names, and employer. Cyberstalkers use these sites to fill in details they can't get from social media. You can request removal from individual brokers manually, but it has to be repeated, since brokers continually pull in new records and sometimes re-add entries you've already had removed.

Securing Your Accounts Before You Report

Stabilize your digital security before you report cyberstalking to authorities, so the perpetrator can't monitor your response. Start with your primary email account. Whoever controls your email controls every service linked to it through password resets, which makes it the highest-priority account to secure first.

Use a password manager to generate long, unique credentials for every account, since reused passwords let one stolen credential unlock multiple platforms. Enable multi-factor authentication (MFA) everywhere it's offered. NIST's Digital Identity Guidelines (SP 800-63B) favor hardware security keys or authenticator apps over SMS codes, which are vulnerable to SIM swapping, a technique some perpetrators use when they already know your phone number to intercept codes and complete an account takeover without your password. Our post on passkeys and stronger two-step verification explains how these stronger authentication methods work if you want to move beyond SMS codes.

Locking Down Social Media

Set every social profile to private and review your followers or connections for unfamiliar or recently created accounts. Remove specific location details from your bio and posts; a general city is usually enough. Disable geotagging in your camera settings, typically under Settings then Camera or Settings then Location, so future photos don't carry EXIF coordinates. Turn off "friends of friends" discoverability and search-engine indexing where the platform allows it. Facebook, Instagram, and X each have a setting that keeps your profile out of Google search results.

Documenting Evidence and Filing a Report

Prosecutors need evidence of a pattern over time, not a single incident. Start a dedicated evidence file as soon as you suspect you're being targeted, even before you're sure the conduct meets your state's legal threshold.

Document every harassing message with a screenshot showing the sender's username, the platform, and the date and time. Save the full URL of any public post targeting you before it can be deleted. Keep a written log of the date, time, platform, what happened, and any witnesses, including any real-world contact you believe was enabled by digital tracking. Do not respond to or confront the person, and do not delete messages even when they're distressing; courts need the original record.

Where to File a Report

Start with an in-app abuse report on each platform involved; most can preserve records under a law enforcement legal hold if notified before an account is deleted. Then contact your local police department and ask them to document the case specifically as stalking or cyberstalking under your state's statute, not a general harassment complaint, since the distinction affects how the case is investigated. If the perpetrator is in another state or country, the FBI's Internet Crime Complaint Center (IC3) accepts complaints that cross jurisdictional lines. The Cyber Civil Rights Initiative runs a crisis helpline and offers legal referrals for victims of online abuse.

Building Lasting Protection Against Digital Surveillance

Cyberstalking rarely exists on its own. It often intersects with identity theft, account takeover, and broader digital exposure that compounds the harm over time. If a cyberstalker has been researching you, there's a real chance some of your credentials have already surfaced in a breach database, so a full account security review is worth doing even after the immediate threat is addressed. If someone has used your information to open accounts or commit fraud in your name, contact the major credit bureaus for a fraud alert and file a report with the FTC at IdentityTheft.gov.

Our guide on protecting vulnerable family members from online scams and identity theft covers related account and identity protections if you're also managing risk for a parent or family member. For a broader look at how attackers profile and research individuals online, see our post on how hackers choose and research their targets.

A VPN, which encrypts your traffic and masks your IP address, adds a useful layer on shared or public networks, but it does not protect you if a perpetrator already has access to your accounts or has installed stalkerware on your device. Treat it as one layer among several, not a complete answer.

Recognizing the signs of cyberstalking early is the foundation. Sustained protection comes from reviewing account access regularly, watching for your information on data broker sites, and staying alert to the pattern described above. If the behavior continues despite your precautions, involve law enforcement, a victim advocate, or a specialized support organization. You don't have to manage it alone.