Can several people share one account?¶
id: "AI-006" title: "Can several people share one account?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
Can several people share one account?¶
Script¶
You have identified the account used during the incident.
That does not necessarily identify the person who used it.
Several people can share access to the same online account.
Families share streaming and shopping accounts. Partners may know each other's passwords. Businesses use shared inboxes, social-media pages and booking systems. Several employees may be authorised to use the same account.
Sometimes the sharing is informal.
A password may be written down, sent in a message or saved on several devices. An account holder may allow somebody else to use the account once, without intending to give them permanent control.
This creates an attribution problem.
Provider records may identify the registered account holder, but those records do not necessarily show who typed a message, uploaded a file or completed a transaction.
You need to examine the activity around the event.
Which device accessed the account?
Was the device used by one person or several?
What IP address, session information or location data was recorded?
Were other accounts used from the same device at the same time?
Who was present and who realistically had access?
The content itself may also help.
Language, spelling, knowledge of events, photographs, contact patterns and working habits can support or challenge a proposed user. None of those features should be treated as conclusive on their own, but together they may help distinguish between possible users.
Do not use the possibility of sharing as an excuse to abandon the enquiry.
Shared access does not mean attribution is impossible. It means the account record must be combined with other evidence.
Equally, do not assume that the registered holder must have carried out every action because the account is in their name.
Establishing that an account was used is one question.
Establishing who used it at the relevant time is another.
Several people can share one account.
Always separate ownership or registration from actual use.