What should people do when normal platform reporting does not stop harassment or stalking?

Escalate to stronger protection steps quickly. Save evidence, document repeated incidents, reduce what the attacker can observe, and tighten account controls and location sharing. If the pattern continues, involve trusted support, workplace security, or law enforcement where appropriate. The article’s core lesson is that helplessness makes the problem worse, while deliberate limits on exposure restore some agency.

When reporting is not enough, shift from complaint to containment

Normal platform reporting often fails because the same account can keep watching, contacting, or reappearing under new handles. The practical response is to reduce the attacker’s visibility and reach at the same time: block what you can, harden account settings, limit profile exposure, and stop unnecessary location and contact sharing. Where the pattern is persistent, treat it as an active safety problem, not just a moderation issue.

Evidence matters because repeated harassment and stalking can be denied, minimized, or fragmented across platforms. Keep timestamps, screenshots, message headers, profile links, and notes about patterns of escalation so you can show persistence rather than isolated incidents. If the behavior crosses into account compromise, do not assume the problem is only social, because credential abuse can make the contact pattern continue even after blocks.

A useful reference point for broader identity risk is Ultimate Guide to NHIs — What are Non-Human Identities, which helps explain why access control, credential handling, and visibility matter once an abusive actor keeps finding a path back in.

What to tighten first when the pattern keeps returning

Start with the controls that most directly reduce exposure. That usually means changing passwords, enabling stronger authentication, reviewing recovery methods, removing shared devices or sessions, checking linked apps, and auditing what personal data is still public. If the platform supports it, restrict messages, comments, tags, friend requests, and search discoverability so the person has fewer ways to reestablish contact.

There is also a location-safety angle. Disable live location sharing, review photo metadata habits, and audit apps or devices that may reveal routine, workplace, or home patterns. If stalking is involved, the goal is not perfect invisibility, but making surveillance less reliable and less rewarding. When a threat feels coordinated, involve workplace security, building management, or a trusted third party sooner rather than later.

For platform and account-control depth, OWASP Non-Human Identity Top 10 is a useful lens on why overexposed access paths, weak rotation, and third-party reach can make containment harder than it first appears.

Risk and Threat Considerations

The main risk is assuming that a report, mute, or block will end the contact path when the attacker may still have alternate accounts, shared access, or enough observational access to keep adapting. Stalking and harassment become more serious when the person can infer routines, retaliate through new channels, or use compromised accounts to bypass normal controls.

Failure mechanism: The attacker keeps a low-cost way to recontact, observe, or impersonate, while the target’s account and location settings remain too open to prevent repeated probing. That creates persistence, repeated exposure, and a higher chance of escalation.

Impact: Continued harassment can become a safety issue, a workplace issue, or an account-security issue at the same time. Once the pattern is established, faster escalation, stronger evidence retention, and broader support are usually more effective than waiting for one more platform action to work.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Exposure	Harassment can persist through exposed or reused access paths.
	NHI-04 — Excessive Privilege and Overexposure	Public visibility and broad access increase stalking and impersonation reach.
	NHI-08 — Third-Party and Delegated Access	Linked apps and shared channels can preserve an abuse path after blocking.
Recommendation — Reduce exposed access paths and rotate any credentials that could let an abuser reenter accounts. Tighten visibility and revoke unnecessary access that broadens the attacker’s reach. Review delegated access and remove any third-party paths that can be abused for recontact.
CIS Controls v8	5 — Account Management	Strong account hygiene helps stop repeated recontact and account abuse.
	14 — Security Awareness and Skills Training	Users need evidence handling and escalation discipline when platform reporting fails.
Recommendation — Harden account recovery, authentication, and session control to close repeat contact paths. Train staff to preserve evidence and escalate persistent harassment through the right channels.
NIST CSF 2.0	PR.AC — Identity Management, Authentication, and Access Control	Limiting who can see, contact, or access accounts directly reduces abuse exposure.
	RS.RP — Response Planning	Persistent harassment needs a defined escalation path beyond ordinary reports.
	GV.RM — Risk Management Strategy	This topic requires decisions about when to move from moderation to protective action.
Recommendation — Restrict account access and visibility to the minimum needed for safe communication. Define escalation steps for persistent harassment so stronger support is engaged quickly. Treat repeated harassment as a managed safety risk and escalate when normal reporting fails.
NIST SP 800-63	IAL — Identity Assurance Level	Identity confidence matters when an attacker keeps returning under new accounts or channels.
	AAL — Authenticator Assurance Level	Stronger authentication reduces unauthorized reentry after blocks or reports.
Recommendation — Strengthen identity proofing and recovery controls where impersonation or account reuse is likely. Use stronger authenticators and protect recovery factors to limit account takeover.

Practitioner Guidance

What to prioritise: Prioritise actions that cut the attacker’s ability to observe, reach, or impersonate, not just actions that express disapproval. If the abusive pattern is repetitive, treat it as a sustained exposure problem and move quickly from platform-only controls to stronger account and personal-safety controls.

What to verify: Verify whether the person still has a live path to contact you through alternate accounts, shared devices, recovery channels, or public metadata. If any of those remain open, the block is only partial and should not be trusted as a complete fix.

Practitioner takeaway: The key judgment is to measure success by whether contact paths are actually shrinking, not by whether a report was filed or a platform acknowledged it.