How should a messaging account be linked to a device or person?¶

You may know which account sent a message but still need to identify the device and person behind it.

Evidential caution: that an account name, telephone number or seized device completes the attribution.

What this means¶

Which account was involved?

Which device or session used the account?

Who controlled that device or session at the relevant time?

Account evidence may include stable user IDs, registration details, linked numbers, recovery information and provider records.

Device evidence may include application data, account tokens, notifications, linked-device records, login artefacts and possession of the device.

Personal attribution may require more: witness evidence, access patterns, passcode knowledge, biometric use, location, surrounding conduct, admissions or content known only to the user.

What to check or do next¶

• Start by separating three questions.
• Preserve the full chain of association. Record how the account was identified, how it was linked to the device and what supports personal control.

Evidential limits¶

Consider alternative explanations. The account may be shared, the device borrowed, a linked web session active or the account compromised.

Timing matters. Possession of a device after the event does not prove control when the message was sent.

Do not rely on one weak bridge. A phone number registered to a person may identify the subscriber, not the user. A device found in a house may not identify who used it.

Report each level separately and preserve uncertainty where it remains.