Becoming a domChapter 3

Stay anonymous

A drawn face can’t leak, but files, names, accounts, tools and payments can. Here’s where the person behind a persona gets exposed, where anonymity ends, and why access to your accounts is never part of the game.

Entry: D3
Category: Becoming a dom
Checked: 3 November 2026
Reading: 9 min
Sections: 6

Evidence

This chapter is not advice for your situation.

In 30 seconds

A drawn persona is anonymous toward the audience. She isn’t anonymous toward the payout.
Only the persona’s name belongs in anything you produce. Clean every file, then check it.
Small public fields, game names and wishlist names connect accounts.
A real dom never needs a password, a login code or a remote session.
If it leaks, stop, secure, keep proof and ask for help.

You will learn

Who can find out who you are, and how.
How to clean files and sites, and how to check a tool before you run it.
Which public fields and names give a person away, for doms and for subs.
Why anonymity ends where the money lands.
What to do when a login request, a threat or a leak shows up.

I keep the persona and the person apart on purpose, and the person’s side is the one I check most often.

Vivian

What you hide, from whom

Anonymity in 2DFD is real, but narrow. It works well toward the audience: a drawn face can’t leak, a clean file carries no coordinates, and an account under a pseudonym shows no name. Compared with classic findom, the drawn character takes the face and the voice out of the deal, and the risk moves to payment platforms, social platforms and the tools used to move money.

Some doms say they’ve been targeted by people threatening them with fake explicit pictures made to look like them. Those threats are scary even when the pictures are known to be fake. A drawn character has no real face to fake, and that’s real protection.

Secrecy has a cost. In a study of findommes, participants named secrecy among the most negative parts of the work. VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026. Keep at least one person you trust who knows what you do.

Who could find out who you are

Scroll the table sideways

Who could find out who you are
Who	How you can leak	What helps
Subs	A bio line, a game name, a name on a wishlist	Public fields that match each other and hold no real-life detail
Platforms	Phone checks, linked accounts, file metadata	Clean exports, one purpose per account
Payment company	ID papers and a bank account	Accept it, and plan for it from the start
Family or employer	A chat left open, a shared computer	A separate profile, a locked screen
Other doms	A name seen on two pages, a handle found in a file	A handle you’re fine being recognised by

This map is from my own experience. There’s no study behind it.

Files, sites and tools

Only the persona’s name goes in anything you produce: files, file names, commits, metadata and screenshots. Never a personal name, an e-mail address or a system path that contains a user name.

Images carry traces: location data, colour profiles, comments, provenance records, prompts stored in text chunks and extra bytes. Videos carry a date, the name of the program and the name of the encoder. Clean every export, then reread the file, and if anything’s left, don’t post it. Clean even when you start clean, because an encoder can add a profile on its own. Test your checker with odd cases, because a hidden note in an unexpected spot once slipped through mine. Treat every picture as copyable too, since anyone can take a screenshot.

Publish an image

Export the file from your tool.
Strip it: location, profiles, comments, prompts and extra bytes.
Reread the stripped file and compare it with a clean sample.
If anything’s left, stop and fix the cause, not the file.
Only then post it.

A site can leak through how it’s built. Serve everything from the site’s own host, with no third-party fonts, trackers or scripts, so only the host sees a visit. Check it from the outside: old versions of a site can stay reachable at hosting addresses you’ve forgotten. Browser safety filters can flag new adult-themed domains early, so test the name and keep a backup.

Code leaks too. Make commits under the persona’s name and in UTC, because a local time offset shows where the author lives. Open a code-hosting account with a pseudonym for both the name and the e-mail, because every change stays in the history. Before you give a tool to others, take out any name, signature and default picture, and strip the source, comments and leftover handles, or someone can repackage it with something added.

Secrets never go through a chat. Type a token or key into a masked prompt in your own terminal, never into a commit, screenshot or message, and send access keys privately so they can be revoked.

A tool can be harmless in code and still unsafe in practice. Check what it sends and to whom, check its defaults as well as its screen, and test it in a virtual machine with no personal network. Don’t run an unknown program on your main computer. Avoid any tool that builds an ID from the computer name or the account name. A safer design starts with everything off, a whitelist, a random ID, a short history and a control channel by invitation only.

Anonymous confession features are only anonymous toward other members. The platform and the host still have the data.

Accounts, names and public fields

Public fields leak more than files. One careless bio line on a related account can show that the person behind a persona isn’t who the persona says. A game or stream name that looks like the persona’s name, or points back to an old dispute, can do the same. Read every public field of every linked account the way a stranger would.

People who run personas often have several accounts. Platform terms may forbid multiple accounts, or a new account after a ban, and a second account puts the first one at risk. Don’t borrow someone else’s phone number for a check. It drags a person who has nothing to do with this into adult activity.

Don’t confirm or explain links between personas. When someone asks about a persona’s contacts or second identities, deflect. Never publicly link a handle you found in a tool’s files to a persona unless the person said so in their own words, because that’s doxxing. Exposing a bad actor also invites revenge, like mass reports from accounts the rival controls. If you show a mentor or a peer anything, show the persona account, never the personal one.

Purging messages and blocking contacts keeps the persona apart from the person, but it also wipes out what you could learn from. Deleting chats after every send is different, because it can be a sign of the spiral. See The spiral.

If you’re a sub

Sender names can show on a public wishlist, and doms look at each other’s pages. Use a handle you’re fine with several doms seeing. Keep a separate account for adult servers, and check who else is in a server before you join, because a server you have in common with someone can expose you. On a shared computer, lock the screen or close the chat, and use a separate profile.

Your name, your address, your workplace and your family are a fair boundary. A dom who needs them isn’t playing a game. Physical gifts break anonymity both ways, so the safe default is no addresses at all, or a neutral forwarding or retail service.

Money is the weak point

Anonymity ends at the payout. In my experience a card processor or an adult payment company ties the persona to a legal identity: ID documents, a business registration and a bank account in the company’s country. An account opened in a real name carries any ban with it, and the ban follows the real person.

The persona is a mask toward the audience and the platforms, never toward the company that pays you. Partial or false details at a processor won’t make you anonymous. They get accounts closed and money held, and a sub’s payment can disappear with them. The authors of a study of findommes flag fraud, including identity fraud, as a remaining risk in this field. VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026.

A persona’s tools hold no names, e-mail addresses or cards. A card stays with the processor. Test any payment flow with a fake provider first, then in the provider’s test mode with its published test cards, and type a real key only in your own terminal. For the full picture, see Getting paid.

Myth
A drawn persona makes everything around her anonymous.
Fact
It protects the face and the voice. The payout, the small public fields and the tools you run still point to a person.
Myth
Throwaway cards and partial details get around a processor’s checks.
Fact
They get accounts closed and money held, and the account follows the real identity.

Access is never part of the game

A real dom never needs your password. Passwords and one-time codes are keys to your identity, and a promise doesn’t protect you. A US cybersecurity alert advises people not to hand control of a computer or phone to a stranger. VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026. A remote-access vendor states that it does not offer remote support services, so a caller claiming to be its support isn’t genuine. VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026.

In this scene the same request shows up inside the game. Press reports describe some doms blackmailing subs. ReportedStated by a serious secondary source read in full.[a former participant] has seen men left broke and hungry from ‘paying women to talk to them’ (opens in a new tab) Accessed 3 November 2026. A first-person account says threats of exposure are a common punishment from financial doms. ReportedStated by a serious secondary source read in full.Diary of a Financial Dominatrix, part one (opens in a new tab) Accessed 3 November 2026. A login handed over as a gesture of trust is really about control, and a fake dom would ask for exactly the same thing.

Red flags

Access requests

A dom asks for your password as proof you’re honest.
A dom asks for the one-time code just sent to your phone or e-mail.
A dom asks for a remote desktop session “to supervise”, and adds that you can always quit.
A dom logs you out of your own accounts, or keeps them open “for you”.
A dom asks for access as the price of forgiveness.

Counter. Say no once, calmly. Offer a screenshot or an export instead. If you already shared anything, change the password and sign out of every session. Don’t argue.

Pressure around privacy
What they say or do	The counter
“Prove you are honest: give me your login.”	A login proves nothing and opens everything. Refuse and show a screenshot instead.
“Why would you want to do this alone?”	Asking you to justify your privacy makes you defend a normal boundary. Say it once: “because I want to” is enough.
“I only want access because I care.”	Wanting into someone’s account because it feels special is a control pattern. Say no.
“That dom is not who she says she is. Leave her.”	Exposing someone to win you over isolates you. Ask why her identity is the argument.

It works the other way too. Giving anyone, even a mentor you trust, full access to the account where your subs talk is risky. The subs can’t speak freely, and the helper can step into conversations. If you share access, tell the subs, exclude specific conversations, and remove the helper’s sessions when trust drops.

A dom asks for a code

You sent a tribute and told a dom you also pay others. She says you can prove you’re honest by reading out the code that just came by text, and promises she won’t do anything harmful. What do you do?

When it leaks

Rumours and screenshots travel fast. A rumour that a dom is secretly a sub can cost her subs, and private images can spread through a shared server before any apology comes. Keep private images and chats out of any shared space.

If your identity leaks

Stop. Don’t confirm or deny any real-life detail.
Secure your accounts: change passwords and sign out of every session.
Save proof with dates before you block anyone.
Report the account to the platform. Don’t pay a blackmailer, and don’t send more material.
Tell one person you trust, and read Where to get help.

Never hand over

Word 1 of 4

0 of 4 known

Word

Password

Password: Never. A real dom never needs it.
One-time code: Never. It opens your account.
Address: Not without a neutral forwarding service.
Card number: Never. The card stays with the processor.

Check yourself

Question 1 of 2Where does anonymity end for a dom?
- At the bio
- At the payout
- At the first post
Answer. At the payout. A processor ties the persona to a legal identity.
Question 2 of 2A dom says you need a reason for your privacy. What is that?
- A fair question
- A pressure pattern
- A required form
Answer. A pressure pattern. A boundary needs no proof.

0 of 2 right

Nothing you answer here is saved or sent.

Remember it

Only the persona’s name goes in anything you produce.
Clean every file, then check it.
Public fields and game names connect accounts.
Anonymity ends at the payout.
A real dom never needs your password or a code.
If it leaks, stop, secure, keep proof and ask for help.

Check it

Every claim with its evidence level and its sources.

Evidence levels

Verified: Checked against the original source.
Reported: Stated by a serious secondary source read in full.
Community: Widely said in the scene; no document proves it.
Vivian’s field notes: First-hand experience, not a study.
Unverified: Plausible, not proven yet.

It works well toward the audience: a drawn face can’t leak, a clean file carries no coordinates, and an account under a pseudonym shows no name.
Compared with classic findom, the drawn character takes the face and the voice out of the deal, and the risk moves to payment platforms, social platforms and the tools used to move money.
Those threats are scary even when the pictures are known to be fake.
A drawn character has no real face to fake, and that’s real protection.
In a study of findommes, participants named secrecy among the most negative parts of the work.
VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
There’s no study behind it.
Never a personal name, an e-mail address or a system path that contains a user name.
Videos carry a date, the name of the program and the name of the encoder.
Clean every export, then reread the file, and if anything’s left, don’t post it.
Clean even when you start clean, because an encoder can add a profile on its own.
Test your checker with odd cases, because a hidden note in an unexpected spot once slipped through mine.
Treat every picture as copyable too, since anyone can take a screenshot.

Show all 60 claims

Serve everything from the site’s own host, with no third-party fonts, trackers or scripts, so only the host sees a visit.
Check it from the outside: old versions of a site can stay reachable at hosting addresses you’ve forgotten.
Browser safety filters can flag new adult-themed domains early, so test the name and keep a backup.
Make commits under the persona’s name and in UTC, because a local time offset shows where the author lives.
Open a code-hosting account with a pseudonym for both the name and the e-mail, because every change stays in the history.
Before you give a tool to others, take out any name, signature and default picture, and strip the source, comments and leftover handles, or someone can repackage it with something added.
Type a token or key into a masked prompt in your own terminal, never into a commit, screenshot or message, and send access keys privately so they can be revoked.
Check what it sends and to whom, check its defaults as well as its screen, and test it in a virtual machine with no personal network.
Don’t run an unknown program on your main computer.
Avoid any tool that builds an ID from the computer name or the account name.
A safer design starts with everything off, a whitelist, a random ID, a short history and a control channel by invitation only.
The platform and the host still have the data.
One careless bio line on a related account can show that the person behind a persona isn’t who the persona says.
A game or stream name that looks like the persona’s name, or points back to an old dispute, can do the same.
Platform terms may forbid multiple accounts, or a new account after a ban, and a second account puts the first one at risk.
It drags a person who has nothing to do with this into adult activity.
When someone asks about a persona’s contacts or second identities, deflect.
Never publicly link a handle you found in a tool’s files to a persona unless the person said so in their own words, because that’s doxxing.
Exposing a bad actor also invites revenge, like mass reports from accounts the rival controls.
If you show a mentor or a peer anything, show the persona account, never the personal one.
Purging messages and blocking contacts keeps the persona apart from the person, but it also wipes out what you could learn from.
Use a handle you’re fine with several doms seeing.
Keep a separate account for adult servers, and check who else is in a server before you join, because a server you have in common with someone can expose you.
On a shared computer, lock the screen or close the chat, and use a separate profile.
A dom who needs them isn’t playing a game.
Physical gifts break anonymity both ways, so the safe default is no addresses at all, or a neutral forwarding or retail service.
In my experience a card processor or an adult payment company ties the persona to a legal identity: ID documents, a business registration and a bank account in the company’s country.
An account opened in a real name carries any ban with it, and the ban follows the real person.
The persona is a mask toward the audience and the platforms, never toward the company that pays you.
They get accounts closed and money held, and a sub’s payment can disappear with them.
The authors of a study of findommes flag fraud, including identity fraud, as a remaining risk in this field.
VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A card stays with the processor.
Test any payment flow with a fake provider first, then in the provider’s test mode with its published test cards, and type a real key only in your own terminal.
The payout, the small public fields and the tools you run still point to a person.
They get accounts closed and money held, and the account follows the real identity.
Passwords and one-time codes are keys to your identity, and a promise doesn’t protect you.
A US cybersecurity alert advises people not to hand control of a computer or phone to a stranger.
VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026.IC3 Issues Alert on Tech Support Fraud (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A remote-access vendor states that it does not offer remote support services, so a caller claiming to be its support isn’t genuine.
VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026.TeamViewer and scamming (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
Press reports describe some doms blackmailing subs.
ReportedStated by a serious secondary source read in full.[a former participant] has seen men left broke and hungry from ‘paying women to talk to them’ (opens in a new tab) Accessed 3 November 2026.[a former participant] has seen men left broke and hungry from ‘paying women to talk to them’ (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A first-person account says threats of exposure are a common punishment from financial doms.
ReportedStated by a serious secondary source read in full.Diary of a Financial Dominatrix, part one (opens in a new tab) Accessed 3 November 2026.Diary of a Financial Dominatrix, part one (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A login handed over as a gesture of trust is really about control, and a fake dom would ask for exactly the same thing.
I track how these requests are worded. The language of trust and the language of a scam overlap completely. When someone says a password proves you’re serious, the request itself is the red flag, whatever they mean by it. A dom who means well doesn’t need your password, and one who doesn’t will say the same words.
Refuse and show a screenshot instead.
Say it once: “because I want to” is enough.
Say no.
Ask why her identity is the argument.
If you share access, tell the subs, exclude specific conversations, and remove the helper’s sessions when trust drops.
A rumour that a dom is secretly a sub can cost her subs, and private images can spread through a shared server before any apology comes.

Download

Stay anonymous
PDF