What is the difference between the device, the phone number and the user account?¶
The device, the phone number and the user account are separate things.
What this means¶
The device is the physical handset or tablet. It has hardware identifiers, storage, an operating system and a record of local activity.
The phone number is a service identifier used by the mobile network. It is associated with a subscription and normally delivered through a SIM or eSIM. The number can move between devices, SIMs and even network providers.
A user account is a digital identity used to access a service. That may be the main Apple or Google account on the device, or an account for messaging, email, social media, banking or another app.
These three elements can overlap, but they are not interchangeable.
One device can use several phone numbers through different SIMs, eSIMs or app-based services. One phone number can move from one handset to another. One account can be used on several devices. One device can hold several accounts belonging to different people.
This matters for attribution.
A provider record linked to a phone number may identify the subscriber or connection, not the person holding the handset at the relevant time.
An app record may identify the account that performed an action, not the physical device or human operator.
A device artefact may show that an account was present or active on the handset, but not automatically who was using it.
The operational takeaway is: treat device, number and account as separate attribution layers. Establish how they were linked at the relevant time, then identify the evidence that connects each layer to the person whose actions matter.
What to check or do next¶
- Investigators should build the links rather than assume them. Useful evidence may include possession, account registration, login history, device identifiers, SIM records, payment details, recovery information, communications, biometric or passcode use, location, witness evidence and consistent patterns of activity.