Skip to main content
Accounts and identity

I have been given an account or username

Treat the account as a collection of provider, session, device and activity records. An account name may identify the service record without identifying the person who controlled each event.

Investigate now

Start with what needs doing now

Use this route to preserve the account context, identify useful provider records and test genuine use against compromise.

Start the investigationWork through an online account

Move from the visible account to identifiers, provider records, sessions, devices and defensible attribution.

Reference AI-000Provider evidenceWhat records might the provider hold?

Identify registration, login, device, recovery, session and activity records that may exist beyond the visible profile.

Reference AI-029Test compromiseGenuine user or intruder?

Compare account, authentication, device and behavioural evidence before attributing disputed activity.

Reference AI-028
Learn

Understand the evidence and the offender method

Use this route to understand what an account is, how control differs from registration and how an offender can exploit account access.

Foundation explanationWhat is an online account?

Understand the service-side record that connects identifiers, credentials, settings, sessions and activity.

Reference AI-001Separate offender exampleSee how Dodgy Dave exploits account access

Follow a separate offender method without confusing it with the investigator walkthrough.

Reference AI-031
Common questions

Go directly to the issue you need to resolve

ControlWho controlled the account?

Distinguish registration from practical control at the relevant time.

Reference AI-011Shared accessCould several people share the account?

Test formal, informal and unauthorised access.

Reference AI-006AuthenticationWhat does a successful login prove?

Use the event without overstating who performed it.

Reference AI-017Alternative explanationCould the account be compromised?

Recognise takeover, stolen sessions and other access routes.

Reference AI-025
Browse every Accounts and identity guidance page The complete reference library remains available when you need a narrower question.