Fictional practice case

Compare account signals

Compare fictional signals, decide what the clues do—and don’t—tell you, and identify the evidence that is still missing.

Two distinct account records share one limited evidence marker.

Scenario

A fictional review contains two lists of account signals. Some values overlap, but the records also come from a shared office network and a managed device pool.

Evidence

Account A signals
office-ip-7
device-pool-3
phone-suffix-0184
shipping-zone-2
Account B signals
office-ip-7
device-pool-3
phone-suffix-7721
shipping-zone-5
Environment
Both accounts can use the same office network and rotating managed laptops.

Your task

Which signals overlap, what hypothesis is reasonable, and what would be needed before linking the account owners?

Show the answer and explanation

What the evidence shows

The shared office IP and device-pool label justify checking whether the sessions are related, but they do not prove common ownership or fraud. Before drawing a conclusion, check the session times, device assignment records, sign-in events, and any ordinary business explanation you’re allowed to review.

Why

  • The intersection is office-ip-7 and device-pool-3.
  • Both overlaps have plausible shared-environment explanations.
  • The different phone suffixes and shipping zones do not disprove a relationship, but they make a single-owner conclusion less supported.

Limits

  • All accounts and signals are synthetic.
  • Shared IP, device, or text values are leads to investigate, not proof of identity, coordination, or fraud.

Outcome: The shared signals don’t prove common ownership or fraud. More evidence is needed before drawing that conclusion.