Skip to content
Skip to main content
Accounts & Identity Technical Explainer

Can one person have several online accounts?

Yes โ€” and that is completely normal.

People often have different accounts for work, shopping, hobbies, family or old services they barely use. The useful question is not how many accounts somebody has. It is whether the accounts relevant to your investigation can actually be linked to the same person or activity.

Useful connections may include:

  • the same recovery email or telephone number;
  • the same payment instrument;
  • recurring device or application identifiers;
  • the same browser or local device artefacts;
  • overlapping session and connection history;
  • saved credentials on one device;
  • matching account-recovery activity; or
  • coordinated use during the incident.

A simple relationship might look like:

MarketplaceFC-88214Recovery mobile ending 6142.
Messaginguser_77192Same recovery mobile and recurring device.
Emaild.foster26Signed in on the same recovered handset.

Those connections can make the accounts worth examining together.

Shared indicators need interpretation

One IP address does not necessarily mean one person. A household, workplace or public network can put several users behind the same connection.

Likewise, one device may be shared.

So prefer combinations of evidence where possible.

For example, the same recovery number plus the same device identifier plus matching local account artefacts is more informative than a single shared network address.

Timing can be very useful

Account use may reveal a pattern.

One account may become active immediately after another is suspended.

Several accounts may be accessed from the same device within minutes.

Two identities may repeatedly appear in the same transaction or conversation.

Those patterns can help you decide which accounts belong in the same line of enquiry.

Do not assume you have found them all

A search may identify three accounts and still miss a fourth.

That is not a reason to keep searching forever. Focus on accounts that can materially answer the investigative question.

If a new identifier appears โ€” a recovery number, service ID or device token โ€” use it to test whether other relevant accounts connect to the same activity.

The practical point is: multiple accounts become useful when independent records show how they connect. Count is not the evidence; the relationships are.

Reference: AI-005Accounts & Identity