When a Message Comes From Your Account, Who Actually Sent It?

When someone else used your account, a key issue in a Texas online messages case is who actually sent the messages. Other elements of the offense also matter, and having an account in your name does not, by itself, show who typed or sent a message from it. This page explains how that question gets examined. It covers the records the state uses, the devices and people with access, compromised accounts, and the evidence to keep. For the wider picture, read our online sex crimes overview.

Why the question of who sent the messages matters

Subsection (b) of Texas Penal Code § 33.021 addresses a person 17 or older who, intending to commit one of the offenses listed in Article 62.001(5)(A), (B), or (K) of the Code of Criminal Procedure, intentionally communicates in a sexually explicit manner with a minor or distributes sexually explicit material to a minor over the internet, by text, or through another electronic message service. Subsection (c) separately makes it an offense to knowingly solicit a minor, over the internet or through another electronic message service, to meet another person for sexual contact, sexual intercourse, or deviate sexual intercourse. The statute looks at conduct, intent and, in part, what the accused believed about the other person’s age.

An account in your name is a starting point, not proof. Accounts can be shared, saved on other devices, synced to the cloud, or accessed by someone who knows the password. A careful defense asks four questions. Which messages are at issue? Which account sent them? Who had access? How was each fact established? These are factual questions. Each answer comes from records, and each record can be checked.

How investigators connect an account to a person

Investigators usually start with account records, then try to tie the account to a device and a person.

Subscriber information is often the first record. Platforms and carriers can show the registered phone number, email address and recovery details tied to an account. These details show who set up the account. They do not show who was typing at a given moment.

Login history, IP address logs and timestamps show when and from where an account was accessed. Investigators compare those points with the accused’s known location and devices. A match is a fact that can be examined. A mismatch is also a fact that can be examined.

Identifying the physical device, such as a phone or laptop, is a separate step. Linking that device to a particular person needs its own proof. Some investigations start with a tip. The National Center for Missing & Exploited Children says it reviews CyberTipline reports and refers them to law enforcement agencies for possible investigation. Each link in this chain can be documented and challenged.

When a family member, roommate or colleague had access

Anyone who could use your phone, computer or logged-in account may have been able to send messages that look like yours.

Shared devices raise the most common open question. A spouse, child, roommate or guest may know your passcode. A family tablet may stay logged in. Saved passwords, open browser sessions and synced cloud accounts let a second person send messages without touching the device. A work laptop that a coworker used can raise the same question.

The key questions are concrete. Who had physical access to each device? Who knew each login? Where was each person at the times the messages were sent? Who else was in the home or office? The defense checks these answers against the timestamps in the records.

People often make a mistake here. They assume a shared device is harmless, or that a family member would never be named. Write down the facts before you discuss them with anyone else. Accurate notes are more useful than memory reconstructed later.

Hacked or compromised accounts: what a forensic review looks for

A compromised account often leaves traces in its login history, recovery settings and list of linked devices.

Signs of compromise can include login alerts from places or devices you do not recognize. You may see password reset emails you did not request. A recovery email or phone number may have changed. Activity may appear at times you were asleep, at work or away from your devices.

A forensic examiner can review device images and account logs. The review looks for remote-access tools, unfamiliar apps, saved credentials and file activity. Two-factor settings, linked devices and session histories can show whether more than one device signed in. These records can support or weaken a compromise theory.

A compromised account does not automatically answer the attribution question. A break-in does not, by itself, show who sent a specific message. The records must be read in context, alongside the timeline and the list of people with access.

Evidence to preserve now

Preserve the devices, accounts and records as they are, and start a written record today.

Do not delete messages, apps, accounts or files. Do not reset, wipe, trade in or replace a phone or computer that holds the messages. Changing data can damage evidence that could help you, and it can damage your credibility.

Keep a written list of everyone who has had access to each device or account. Include family members, roommates, coworkers and anyone who knew a password. Note when each person had access, as closely as you can.

Build a timeline of where you were and which devices you had with you on the dates and times of the messages. Note anything you can verify with receipts, calendar entries or location history. Keep the original emails and login alerts about password changes, new sign-ins or account notices. Bring every device, login and recovery detail you have to the first meeting so it can be preserved properly.

How the defense tests the state’s proof of attribution

The defense tests the state’s proof by checking the underlying data, not only the conclusions drawn from it.

Records requests and subpoenas can obtain the platform, carrier and device data the state relied on. The defense can then compare the state’s conclusions with the raw records. Summaries can leave things out, so the defense checks what the summary says and what it does not.

Common points of examination include chain of custody, the method used to extract data, and whether timestamps are recorded in a consistent time zone. A defense forensic examiner can review devices and account data independently. The examiner can explain what the data shows and what it does not show.

Where images are involved, Texas law also addresses altered content. Under Texas Penal Code § 21.165, it is not a defense to prosecution that the deep fake media contains a disclaimer stating that the media was unauthorized or that the person appearing to be depicted did not participate in its creation or development, or that it indicates, through a label or otherwise, that the depiction is not authentic. So the review asks whether any image was created or altered, and by whom.

The goal is to identify what the records prove, what they do not prove, and where the gaps are. No lawyer can predict or promise a result in any case. The specific charge and its elements depend on the facts of each case.

If your account was used and you are facing this charge

If messages went out from your account and you did not write them, you do not have to work out the proof alone.

Start with three facts: which messages, which account, and who had access. A lawyer can review those facts with the records the state may use. We can look at the messages, the account data and the access list, then explain what the state must connect and how the defense tests it. To talk through your situation, contact Barbieri Law Firm and send your case details. The initial consultation is free, confidential and carries no obligation to continue.

For related reading, see the guides on bond conditions for internet and phone use, telling an employer about an arrest, and sexting between adults.

Common questions