Accounts & Identity Foundation Explainer

What is an online account?¶

An online account is a continuing record maintained by a service so a person, organisation, device or software process can use that service. It can connect activity over time - but it is not automatically a verified person.

In one sentence

The account is the provider’s record; the profile is what is presented; a session is one period of access. Keeping those ideas separate prevents a username from quietly turning into a human being in an investigator’s notes.

Registration

Account ID

Profile

Session

Activity

Records

The account sits behind what the user sees¶

A marketplace user may see Fenland Classics, a photograph and a seller rating. Behind that presentation, the provider may maintain account FC-88214, recovery details, settings, access sessions, security events, adverts and messages.

What other users seeFenland ClassicsA display name and profile that may be changed, copied or invented.

What the provider usesaccount_id=FC-88214A stable internal reference connecting records across the service.

The username may be used to sign in or identify the account publicly. The profile contains information displayed about it. Neither needs to be unique or permanent; account, profile and username are different parts of the service. The internal account ID is often the better reference for a preservation or disclosure enquiry.

Registration does not equal identity¶

Accounts are created under very different conditions. A bank may verify a customer’s identity. A forum may require only an email address. A marketplace may verify some sellers but not others. Details can be genuine, false, stale or borrowed.

Simplified account record

account_id=FC-88214display_name=Fenland Classicsname_supplied=David Fosterrecovery_mobile=+44••••••6142created=2026-08-02T19:14:22Z

Established these values were associated with the accountStill open who supplied and controlled them

It is safe to say the provider recorded “David Foster” against the account. It is not safe to quietly shorten that to “David Foster created the account” unless further evidence supports it. Whether an account identifies a person depends on what was verified and what later evidence connects its use to that person.

One account can have several sessions¶

A session is a period during which an account is accessed through an application, browser or device. Several sessions may exist at once. A user may remain signed in for weeks, use several devices or authorise another service to act through the account. A successful login record establishes what the service accepted under its rules; it does not by itself name the person at the keyboard.

Account creationThe provider establishes the continuing account record.

Phone sessionThe application signs in and receives a session or device token.

Laptop sessionThe same account is accessed through a browser elsewhere.

ActivityMessages, adverts or changes are recorded against one or more sessions.

This is why “the account did it” is often only the beginning. The account identifies the provider record. Session, device and surrounding evidence help establish how a particular event occurred.

The account holder, controller and user may differ¶

EstablishedThe provider associates details, permissions and activity with a continuing account.

Still openWho controlled the relevant session and performed the activity at the relevant time.

An account may be shared within a family or business, delegated to an employee, compromised by an offender, accessed through a stolen session or operated automatically. Those are possible explanations to test - not warnings requiring investigators to abandon the enquiry. The practical question is who controlled the account at the relevant time.

Useful corroboration may include:

recurring device or application identifiers;
precise login and activity times;
recovery or security changes;
messages and payments connected to the account;
possession and examination of a relevant device;
conduct showing knowledge of information available only to the user.

Several independent features agreeing can be powerful circumstantial evidence. A recurring device identifier, matching local artefacts, precise provider times and conduct known only to the operator may together support account control far more strongly than any registration name alone.

Operational takeaway

Use the account as the spine of the enquiry, not as a substitute for a person. Preserve its stable ID, understand what the provider recorded and connect the relevant session and activity to devices, communications, payments and real-world evidence.

Investigator walkthroughWork from a reported marketplace account to suspects →Separate offender exampleSee Dodgy Dave create a fake recruitment account →

Explore the linked account questions