What does an account-holder result actually establish?¶
title: "What does an account-holder result actually establish?" card_id: "IP-079" status: "complete" source_document: "https://docs.google.com/document/d/1K0AX0eOI548vk9HD6G597wRqepqjuN6m8klKfgYJaKk/edit?usp=drivesdk"
What does an account-holder result actually establish?¶
A provider or platform returns the name attached to an account.
It is tempting to treat that as the identity of the user.
But the result establishes something narrower.
It shows that the service’s records associate the account with particular registration or customer information.
That information might include a name, email address, telephone number, billing details or payment method.
The account holder may genuinely be the person who created and used the account.
But there are several other possibilities.
The details may be false, incomplete or out of date.
The account may have been created using another person’s identity, email address or payment card.
It may be held by a company, family member or administrator and used by several people.
Credentials can be shared, stolen or compromised.
An account may also be operated automatically through software or accessed from several devices and locations.
Payment information can strengthen the link to a person, but it still needs interpretation.
The payer, account holder and person controlling the activity aren't necessarily the same.
The service’s access records may help show which IP addresses, devices or sessions used the account around the event.
Device examination, communications, recovery details, control-panel activity and other evidence may help establish who actually controlled it.
The account result should therefore be described accurately.
It may identify the nominal holder or registration details associated with the account.
It doesn't automatically prove that those details are true—or that the named person performed the activity being investigated.
The stronger conclusion comes from connecting the account with its use at the relevant time.
An account-holder result is an attribution lead.
Moving from the name on the account to the person responsible requires evidence of access, control and involvement in the particular event.