Who created the account?¶
id: "AI-010" title: "Who created the account?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
Who created the account?¶
Script¶
You have identified the account.
Now you want to know who created it.
That sounds straightforward, but account creation is not always the same as account ownership, control or use.
A person may create an account for themselves. They may also create one for a partner, relative, employer, client or organisation.
An employee may set up a company account and then hand it over. A parent may create an account for a child. An offender may create an account using somebody else's identity, telephone number or payment method.
So what should you look for?
Start with the creation records.
When was the account created?
What IP address, device or browser was used?
What email address or telephone number was supplied?
Was any payment method added?
What verification steps were completed?
Then ask who controlled those identifiers at the time.
A telephone number linked to the account today may not have been linked when it was created. An email address may have changed hands. A device may have been shared or later sold.
The timing matters.
Compare the creation time with device records, travel, work patterns, messages and other known activity.
Was the person in a position to create the account?
Did the account appear on one of their devices immediately afterwards?
Were welcome emails, verification codes or password-manager entries recovered?
Creation records can be highly useful, but they still need interpretation.
An IP address may identify a connection, not a person. A device may have several users. Registration details may be false.
Do not report that somebody created an account merely because their name appears on it.
Say what the evidence actually shows.
For example: the account was created using this device, this connection and these contact details at this time.
Then explain how those facts connect to the person you are investigating.
Who created the account is a distinct question.
Answer it using the creation event, not assumptions based on who later used or held the account.