How should uncertainty about account control be reported?¶

State the proven account activity, the evidence bearing on control and the realistic unresolved alternatives, using confidence language justified by the record.

Uncertainty defines the conclusion's boundary¶

Separate registered holder from proven operator. Summarise endpoint, session, IP-related, authentication and transaction evidence, then address sharing, compromise, remote control, associate use or deception where materially supported.

A familiar route may not exclude takeover; a new endpoint may be legitimate. Do not list purely theoretical possibilities.

Explain why confidence has its level¶

Use terms such as consistent with, supports, strongly supports or does not establish and give the reasons. Identify contradictions, missing records and evidence that could resolve the issue.

Where two plausible users cannot be distinguished, say so. Transparent limitation strengthens rather than weakens a defensible report.