How should uncertainty about account control be reported?¶

Uncertainty about account control should be stated clearly, with the competing explanations and evidential limits identified.

Avoid this assumption: That uncertainty should be hidden, softened or replaced with confident language to make the report sound stronger. Start by distinguishing the registered account holder from the person proven to have accessed or operated the account.

Identify what the provider records show, including devices, sessions, IP addresses, authentication events and transaction activity.

Then explain what remains unresolved.

The account may have been shared, compromised, remotely controlled, operated by an associate or used under deception.

A familiar device or network may support normal use but may not exclude remote access or session takeover.

A new device may indicate takeover, but it may also reflect legitimate replacement or travel.

Do not list every theoretical possibility.

Report realistic alternatives that are supported by the evidence or materially affect the conclusion.

Use calibrated wording.

For example, say that the evidence is consistent with, supports, strongly supports or does not establish personal control.

Explain why.

Identify contradictions, missing records and the further evidence that might resolve the issue.

Where the evidence cannot distinguish between two plausible users, say so rather than selecting one without a defensible basis.

Uncertainty does not make the evidence useless.

It defines the proper limit of the conclusion.

When reporting, separate proven account activity from inferred personal use and record the confidence level proportionately.

Operational takeaway¶

Report account control with calibrated language, identify realistic alternatives and state clearly where provider, device or contextual evidence cannot support a firmer personal attribution.