Could the phone have been lost, stolen or borrowed?¶

Yes. Each is a plausible alternative to usual ownership, but it should be tested against a relevant-time device, subscription and behaviour timeline.

Fix the period of changed control¶

Record the last confirmed possession, missing report, relevant activity and recovery. Network reports, insurance claims, replacement SIMs, remote-lock attempts, security alerts, password changes, location shifts and witnesses can support or challenge loss or theft.

Borrowing may preserve usual account synchronisation while calls, browsing or particular apps show a different user. A handset and SIM may also separate, producing different device and subscription trails.

Compare behaviour before and after¶

Examine changes in contacts, language, communication, photographs, location, Wi-Fi, Bluetooth, payments and application use. Registration remaining unchanged neither proves nor disproves changed control.

State whether the evidence supports ownership, possession and use separately. The next card explains how positive evidence can identify the actual user.