Accounts & Identity Operational Explainer

Who created the account?¶

If account creation matters, work from the creation event itself rather than from whoever happens to hold the account now.

The creator, registered holder, later controller and current user can all be different people.

Start with the provider's creation record¶

Useful fields may include:

account ID;
creation date and time;
source IP address;
browser or application;
device or installation identifier;
email address or telephone number supplied;
verification method;
payment method;
referral or invite information; and
any security or recovery details added at creation.

A simplified return might look like:

Example account-creation event

account_id=FC-88214created=2026-08-02 19:14:22 UTCsource_ip=203.0.113.42client=Android apprecovery_mobile=+44••••••6142

That gives you a specific event to investigate.

Follow the identifiers that existed at that time¶

Creation is a dated event. Current account settings may have changed since then.

A recovery number may have been replaced. A payment method may have been added later. The account may now be used on completely different devices.

So when identifying the creator, favour evidence that was present at or around the creation time.

Useful comparisons include:

subscriber or provider records for the supplied number;
the device that received a verification code;
browser or app artefacts;
welcome emails;
password-manager entries;
local account databases;
payment records; and
communications arranging the account creation.

An IP address is useful, but it is not the creator¶

The creation IP may identify a connection used at the time.

That can lead to subscriber, workplace, VPN, hosting or other network records, but it does not automatically identify the person who created the account.

Likewise, a device record may still leave more than one possible user.

Creation eventAccount created at 19:14Provider fixes the time and account.

IdentifiersIP, number, deviceTechnical routes connected to creation.

CorroborationDevice and real-world evidenceWho controlled those routes at the time?

CreatorPerson supported by the combined evidenceCreation is one dated step in the account history.

Creation is not permanent control¶

Somebody may create an account for another person, for a business, or under somebody else's details.

The account may later be shared, sold, compromised or recovered.

So even a strong conclusion about who created the account should not silently become a conclusion about every later event.

Who controlled the account? is the next question if the investigation moves beyond creation.

The practical point is: attribute creation from the evidence around the creation event. Do not work backwards from the person who happened to hold the account later.