Fictional practice case
Compare account signals
Compare fictional signals, decide what the clues do—and don’t—tell you, and identify the evidence that is still missing.

Scenario
A fictional review contains two lists of account signals. Some values overlap, but the records also come from a shared office network and a managed device pool.
Evidence
- Account A signals
office-ip-7 device-pool-3 phone-suffix-0184 shipping-zone-2
- Account B signals
office-ip-7 device-pool-3 phone-suffix-7721 shipping-zone-5
- Environment
Both accounts can use the same office network and rotating managed laptops.
Your task
Which signals overlap, what hypothesis is reasonable, and what would be needed before linking the account owners?
Show the answer and explanation
What the evidence shows
The shared office IP and device-pool label justify checking whether the sessions are related, but they do not prove common ownership or fraud. Before drawing a conclusion, check the session times, device assignment records, sign-in events, and any ordinary business explanation you’re allowed to review.
Why
- The intersection is office-ip-7 and device-pool-3.
- Both overlaps have plausible shared-environment explanations.
- The different phone suffixes and shipping zones do not disprove a relationship, but they make a single-owner conclusion less supported.
Limits
- All accounts and signals are synthetic.
- Shared IP, device, or text values are leads to investigate, not proof of identity, coordination, or fraud.
Outcome: The shared signals don’t prove common ownership or fraud. More evidence is needed before drawing that conclusion.