From Username to Real Name: How Police Connect an Online Account to a Person
Two recent cases show how an account gets tied to a person
In a recent Florida case, according to news reports, a major social media company flagged a file uploaded through its messaging service and sent a tip to law enforcement. Police said internet, cellphone, and email records helped them connect the account to a person, and a search warrant for that person’s electronic devices followed. The arrest came more than two years after the upload. In a separate recent federal case, investigators said they used records from a messaging app, a phone carrier, an internet provider, a dating site, and Google to link several online accounts and their contact information to one person. The charges in both cases are allegations, and anyone accused of a crime is presumed innocent unless proven guilty in court.
Attorney Ron Frey is not commenting on either case or on anyone involved in them. They are mentioned only because they show a question at the center of many internet crime investigations: who is actually behind an account? A username, a display name, or a profile photo does not identify anyone on its own. Social media, messaging apps such as Telegram, Kik, and Messenger, email, and cloud storage accounts may be traced back through records, and investigators often spend months building that link before anyone is contacted.
Where an investigation usually starts, and why it can take so long
Many investigations begin with a report from the company that runs the platform. Social media, messaging, email, and cloud services may scan for or receive reports of suspected illegal content, and when they believe it may involve the exploitation of a child, they may send a report to the National Center for Missing and Exploited Children (NCMEC). Our post on what happens after a CyberTipline report explains that process in more detail. Other investigations start with an undercover officer chatting online, a complaint from another user, or information that comes up in a separate case.
A tip usually identifies an account, not a person. It may include a username, an email address or phone number, an IP address, and the date and time of the activity. In general terms, delays between the activity and any contact from law enforcement can happen because:
– Reports can be numerous, and each one has to be reviewed and routed to the agency that covers the area where the account appears to be.
– Records requests take time. Investigators may need to go to several companies, one after another, and wait for each response.
– Device examinations can back up. Forensic review of phones and computers can take months.
– Charging decisions come later. Even after a search, prosecutors may take time to decide whether to file charges.
A long gap between the activity and any contact does not by itself mean an investigation has ended.
What records can point to a person
Every platform works differently, and what is kept depends on the company, its policies, and the account’s settings. In general terms, records investigators look for include:
– Subscriber information: the name, email address, phone number, and other details given when the account was created, along with the date it was opened. Names are often made up, but phone numbers and email addresses can lead somewhere.
– IP addresses: the internet address used to create the account or log in, with dates and times. An IP address generally points to an internet connection, such as a home Wi-Fi network or a cell phone account, not to a specific person.
– Internet provider and carrier records: once investigators have an IP address and time, they may ask the internet provider or phone carrier which customer account was assigned that address at that moment. That often produces a name and a service address.
– Phone numbers and email addresses used to register: a recovery email or a verification phone number can tie one account to others, such as a Google account or an email account that holds more identifying information.
– Linked accounts across services: the same phone number, email, username, profile photo, or payment method showing up on social media, messaging apps, dating sites, payment apps, and cloud storage.
– Device identifiers: some services record information about the phone or computer used, such as device models, app installation details, or other identifiers that can match a device later found in a search.
– Timing: activity on one account that lines up with logins, messages, or location data from another account or device.
Platforms differ in what they keep. Our posts on Facebook and Messenger evidence and Telegram evidence look at two of them.
How investigators get the records, and the device search
Law enforcement can go to platforms, internet providers, and phone carriers directly. In general terms, the tools investigators use include:
– Preservation requests, which ask a company to hold on to an account’s records while investigators seek formal legal process.
– Subpoenas, which may be used to request certain subscriber and connection information.
– Search warrants and court orders, which may be sought for more detailed records, such as message content or stored files.
Which process is required depends on the type of record, the court, and the law that applies, and that is evaluated case by case.
Once records point to a home or a person, investigators often seek a search warrant for phones, computers, and other devices (see what to do if police seized your computer). A device search may be used to look for the same app or account logged in, saved passwords, matching files, messages, or browser history, all aimed at connecting the account to the device and the device to its user. In cases involving child sexual abuse material (CSAM), formerly called child pornography, the device search is often a central part of the case.
Why a link to an account is not the same as proof
Attribution can look convincing on paper, but records show connections, not necessarily who was typing. In Attorney Ron Frey’s view, questions that may matter include:
– Who else used the connection? Shared Wi-Fi, roommates, family members, guests, open or poorly secured networks, and public hotspots can all put many people behind one IP address.
– Who else used the device or account? Phones and computers get shared, accounts stay logged in, and passwords get borrowed or stolen. The name on an account does not by itself prove who used it.
– Was the address or identity disguised? VPNs, proxies, and other services can hide where activity came from, and phone numbers, email addresses, and profiles can be spoofed or set up in someone else’s name.
– Do the times really line up? Records can be in different time zones, IP address assignments change, and data that is months or years old may no longer reflect who lived at an address or used a connection.
– Are the records authentic and complete? Records produced by a company, screenshots, and forensic reports are different things, and gaps or missing context can change how they read (see questioning the biography of a digital file).
– How were the records obtained and kept? Whether the legal process was proper, whether a warrant’s scope was followed, and whether records were preserved can all be important (see what if the government fails to preserve digital evidence).
Every situation is evaluated case by case under current law, and each needs a tailored response. Laws change, and what applies depends on the facts and the court. Please don’t rely on what the internet or AI tools say about your specific situation.
Talking to an attorney
If a platform tip, a records request, or a search warrant has come up in an investigation, Attorney Ron Frey generally advises people to remain silent and speak with an attorney. Every situation is unique, and contacting an attorney is a priority to get tailored advice.
Attorney Ron Frey of The Frey Law Firm, LLC, a conference speaker and published author, represents people facing internet and computer crime investigations and charges. For a free, confidential initial consultation, call (844) 766-3739 nationally or (813) 775-2276 in Florida. You can also reach the firm through the contact page.
Journalists covering digital evidence and online investigations can reach Attorney Ron Frey through the Media Inquiries page.