Guide

Stolen aged accounts: why account age alone proves nothing

5 minute read

The first thing most people check about a Reddit stranger is how old the account is. It is also the first thing the account market learned to sell. An account can be nine years old and three weeks into a new owner, and the age check cannot tell the difference.

Why age became a shorthand for trust

Age is visible on every profile, takes two seconds to check, and feels like proof of investment: surely nobody nurtures an account for years just to steal a graphics card. Communities leaned on the same logic, gating participation behind minimum age and karma to keep drive-by scammers out. The logic is sound as far as it goes. Its side effect is that account age acquired a price, and anything with a price gets supplied.

Where aged accounts come from

Three routes, none exotic. Some are sold by their original owners, who walk away with a little money and leave their history behind. Some are hijacked, usually through passwords reused from old data breaches, and the real owner may not notice for months if they had drifted away from the site. And some are farmed: run for years on low-effort reposts and pasted comments, accumulating age and karma as inventory. In every case the thing being manufactured is the same product, an account that passes the two-second check.

None of this requires a sophisticated buyer, either. Accounts are listed openly on marketplace sites with age and karma as the headline attributes, priced like the commodities they are. The barrier to entry is not skill. It is a small amount of money that a working scam pays back many times over.

The inherited record problem

A hijacked account does not arrive empty. It arrives wearing its victim's entire life: years of genuine comments, real arguments, niche hobbies, sometimes trade history and flair in the very subreddit where it now sells. Every reputation system inherits this weakness, from subreddit flair to karma thresholds to Vetall itself, because public history is all any of them can read. A stolen aged account inherits its victim's record until its behaviour changes. That sentence is uncomfortable, and it is the truth about every trust signal built on history.

It is worth sitting with what that means in practice. The flair you trust was earned by someone else. The comment history you skim was written by someone else. Until the new owner starts typing, there is genuinely nothing in the public record that says the hands have changed.

The created-versus-active gap

Which is why the useful question is not how old the account is but where its activity actually lives. Open the profile and find the earliest visible activity, then the most recent stretch. An account created in 2017 that has commented steadily ever since is what the age check hopes to find. An account created in 2017 that went silent for years and woke up three weeks ago is the opposite: age acquired, then activated. Watch for the scrubbed variant too, an old account whose history has been wiped, leaving age with nothing behind it. Old and empty is not reassuring. It is the exact silhouette of a sold account.

The gap sometimes has an innocent explanation, because people do leave and come back. The question is what they come back to. A returning human resumes their old life, the same subreddits, the same tone, the same arguments. A new owner comes back to a job.

Behaviour change is the tell

Passwords change hands invisibly. Behaviour does not. A new owner writes at different hours, in different rhythms, with different spelling habits, and about different things, and the seams show where the old life meets the new one. Years of photography chat that hand over to gift card sales. A steady evening poster who now posts around the clock. Repetition where there used to be conversation. Humans skim and miss this; it hides in boring detail across hundreds of comments. Machines are much better at noticing that a rhythm broke.

You can run a rough version of this by hand: read a handful of the account's oldest comments, then a handful of its newest, and ask whether they sound like the same person on the same subjects. When the answer is no, the cake day stops mattering entirely.

What to do with all this

Demote age from verdict to data point. Check the gap between created and active before anything else, read for continuity of interests rather than length of tenure, and treat any account whose recent behaviour breaks with its past as new, whatever the cake day says. This is also how Vetall reads accounts: a check runs through roughly two hundred recent public comments and posts, so the score leans on what the account is doing now, with account age as one measurement among several alongside posting rhythm, repeated text and subreddit spread. An old account behaving like a fresh scam operation scores like one.

And when the recent record is too thin to weigh, the check returns not enough to judge rather than guessing, which for a marketplace decision is often the most useful verdict of all. It tells you the burden of proof stays with them.