I have been given an online account. What happens next?¶
A victim has reported a marketplace account called Fenland Classics. It advertised a motorbike, moved the conversation away from the platform and supplied the bank details used for a £1,850 payment. The profile looks like a person; the investigation must establish who actually created, controlled and used it.
No single field has to solve the case. The value comes from independent records beginning to describe the same activity.
The report¶
The victim supplies screenshots of the advert and profile. The seller displayed the name Fenland Classics, claimed to be based locally and had several favourable reviews. The victim paid after exchanging messages with the seller, but the motorbike never arrived and the account disappeared from public view.
Screenshots preserve what the victim saw. They do not necessarily preserve the platform’s internal account identifier, the complete conversation, deleted material or the sessions used to operate the account.
market.example/fenland-classics4219 · reference BIKE27Work the account as evidence¶
01 · Preserve the account that sits behind the profile
The public name can change; the platform’s internal account and content identifiers are the more durable starting points.
Record the profile URL exactly, including any numeric or service-specific identifier. Preserve the advert, images, messages, dates and the circumstances in which they were obtained. Ask whether the victim still has the original device and whether the conversation remains accessible.
A prompt preservation enquiry to the platform uses the profile address, advert, known times and victim’s account to identify the relevant service records. The aim is not to ask vaguely for “everything about Fenland Classics”; it is to preserve the account, advert, messages and access activity connected to the reported transaction.
A deleted or renamed profile may still correspond to a stable provider-held account. Without that identifier, later enquiries risk chasing a display name that anyone could reuse.
Go deeper: What is the difference between an account, a profile and a username? · What information can an online account contain?
02 · Read registration details as claims, not conclusions
The provider identifies account FC-88214. It was registered as “David Foster”, but the supplied name was not verified.
FC-882146142d.foster26@postbox.exampleAD-7719The name is useful because it can be tested. It is not yet personal attribution. The recovery details are also links to other services, not automatic proof that their registered subscriber operated the marketplace account. The provider may hold much more than the visible profile; account records can include stable identifiers, recovery changes, security events and access history.
FC-88214.03 · Follow the access sessions, not merely the sign-up form
The advert, messages and later deletion were carried out through sessions sharing the same application installation identifier.
The recurring token is a strong continuity feature because the same provider-defined identifier appears across creation, publication, messaging and deletion. It does not identify a human by itself: the service must explain what the token represents, how stable it is and whether it can be reset or shared. Account-control evidence then tests who used the associated session and device.
Precise times allow the sessions to be compared with the private messages, payment and any device later recovered.
Go deeper: What does a successful login actually prove? · What is a session?
04 · Follow the independent links
The recovery mobile is subscribed in Ellis Ward’s name. The receiving account belongs to Sam Dyer. Neither fact finishes the attribution exercise.
Subscriber records associate the mobile ending 6142 with Ellis Ward at the relevant time. A subscriber is not automatically the person using a number, but the distinction between subscriber, account holder and user tells the investigator what must be tested next. The payment supplied through account FC-88214 went to an account in Sam Dyer’s name. The platform’s records also show the seller moving the victim to a private messaging account using the same recovery number.
This is meaningful corroboration, not merely a list of coincidences. The same telephone number independently connects the marketplace and messaging accounts; the matching payment details connect both conversations to the victim’s transfer. Ellis therefore becomes a properly supported suspect in the account-control line of enquiry. Sam becomes a suspect in the proceeds line because Sam’s account received and rapidly moved the money. Possession, account control, knowledge and intent still require testing, but the investigation now has strong, specific propositions to put to both suspects.
Bring the records together by event and time while retaining the provenance of every provider return and the separate record of each investigator action. Use the joined sequence to identify where independent records agree, where the developing account is supported and where another explanation remains realistic.
05 · Test the account against a device and the wider case
A handset recovered from Ellis is signed into the private messaging account and retains the marketplace installation associated with token DT-44.
The handset does not become conclusive merely because it is found near Ellis. Record possession and continuity, then examine whether its accounts, application data, notifications, images and timestamps correspond with the provider records.
The copied motorbike photographs, seller-account artefacts and private chat connect the handset to several independent parts of the operation when their identifiers and timestamps agree with the provider records. Communications with Sam around the payment may then address cooperation and knowledge. This is a strong circumstantial combination: possession, active sessions, matching local artefacts, provider events and proceeds all point in the same direction. An interview can test those specific facts rather than asking whether Ellis has “ever heard of Fenland Classics”.
Where this leaves the investigation¶
FC-88214 published the false advert, sent payment details and was later deleted.The account has done its job: it has moved the investigation from a public profile to stable provider records, connected services, a device and two properly defined suspects. It has not replaced the need to prove personal responsibility.
