How Prop Firms Should Interpret Account-Linkage Evidence

An Operations Manager opens two account records that appear separate. Over several sessions, both accounts have used the same network address. On two of those sessions, the same device identifier also appears. The overlap matters, but the records do not explain why it happened or who was using the accounts.

This is the central challenge in account-linkage review. Technical identifiers can reveal correlations that deserve attention. Shared accommodation, an office network, travel, family use, or another ordinary circumstance can produce some of the same observations.

The useful question is therefore narrower than "Who owns these accounts?" Staff need to ask what was observed, how strongly those observations suggest a relationship, and what further checks their own process requires.

IP addresses and device fingerprints can strengthen evidence that accounts may be related by showing repeated or combined identifier correlations. They cannot prove who owns or controls an account. A sound review separates observation from inference, then leaves the policy treatment and final decision with firm staff.

Begin with a question the evidence can answer

"Are these accounts linked?" compresses several different questions into one. A review may be looking for a shared network, a shared device environment, recurring overlap across sessions, or technical context that supports examining an account relationship.

Define the immediate question before reading the result. For example:

Do these accounts share technical identifiers often enough, or in a strong enough combination, to justify further review under our policy?

That wording gives the evidence a proportionate role. A correlation can support further examination. It does not identify a person, explain the circumstances, or settle how the firm's terms apply.

The scope should stay within the firm's own available records. There is no basis for assuming visibility into activity held by other firms.

Understand what each correlation contributes

An IP address records a network address observed at a point in time. If two accounts share one, the firm has evidence of network overlap. The meaning depends on frequency, timing, and context. One appearance on a shared connection carries a different implication from repeated overlap across several sessions.

A device fingerprint correlates characteristics associated with a device or operating environment. A shared device identifier can strengthen the indication that accounts used the same or a closely matching setup. It still cannot show which person was at the keyboard.

Used together, the identifiers can add context:

• a shared IP indicates a common network address;
• a shared device identifier indicates a common or closely matching device environment;
• repeated appearances make the correlation less isolated; and
• both identifiers recurring across the same accounts can strengthen the reason to examine a possible relationship.

Strengthening an indication is different from establishing a fact about ownership or control. Precise language keeps that distinction visible throughout the review.

Work through an illustrative account scenario

Consider this illustrative firm-side scenario. Accounts A and B access the firm's programme over a two-week period. They share one IP address on four sessions. On two of those sessions, the same device identifier appears. The trade and account records remain separate.

The team can now ask practical questions:

1. Were the overlaps close in time?
2. Did the device correlation recur, or was it observed once?
3. Is the IP address shared by many accounts within the firm's own records?
4. Does information already available to the firm provide a plausible explanation?
5. Does the firm's policy call for another check when both network and device correlations recur?

Suppose the records show that Accounts A and B used the same IP on four dates, with the same device identifier on two. That combination is stronger than one shared IP event. It still leaves open several explanations. Both accounts may belong to people in one household. They may use a common workplace or machine. The observed data alone cannot distinguish among those possibilities.

The correct output from this scenario is a well-scoped case for examination: recurring IP correlation, supported by two device correlations, with dates and account references recorded. Any explanation or policy treatment comes later.

Preserve the Observed, Inferred, Decided triad

A simple three-part structure prevents technical evidence from being overstated.

1. Observed: Accounts A and B shared a network address on four sessions and a device identifier on two sessions.
2. Inferred: The repeated and combined overlap may indicate a relationship between the accounts that warrants further examination.
3. Decided: After considering the correlation, available context, and its own procedure, the firm records how it will treat the case.

Only the first statement comes directly from the technical observation. The second is a reasoned interpretation with uncertainty attached. The third applies the firm's policy.

This triad also improves internal communication. "Same owner" says more than the evidence can support. "Recurring IP and device correlation observed across two accounts" tells a Risk Director exactly what the record contains. If the team later reaches a conclusion, that conclusion can be recorded separately with the basis for it.

Compare the strength of patterns, not just matches

One match and a recurring pattern should not be discussed as if they carry the same weight. Reviewers can assess the shape of the evidence without turning it into a universal score.

Useful dimensions include recurrence, combination, timing, and plausible context. A recurring device correlation may add more weight than a one-off network overlap. IP and device observations pointing toward the same pair of accounts may be more informative than either appearing alone. A known shared setting may change how the firm interprets the same facts.

Alternative explanations belong in the record because they affect the inference. They do not erase an observation. Likewise, the presence of a correlation does not erase uncertainty. A careful review keeps both visible.

How Stackorithm can support this work

Within Stackorithm's trader-intelligence platform, IP and device fingerprinting correlates identifiers across accounts to strengthen account-linkage evidence. It is one input in an account review, not a statement of ownership.

The firm still decides whether the pattern warrants further verification and how its policy applies to the case.

Take one past account-linkage case and rewrite the record under three headings: Observed, Inferred, and Decided. Remove any conclusion from the Observed section that the identifiers alone cannot establish.

See how Stackorithm strengthens trader intelligence with IP and device correlations that support account-linkage review.

Book a demo