One identity, several payment paths
A prospective look at the questions, records and possible outputs of a scoped investigation.
Situation
A person suspects that someone presenting themselves as a trusted contact or organization used several wallet addresses to request payments. The records contain several addresses but do not establish who controlled them.
Evidence to examine
message exports, profile identifiers, payment requests, transaction IDs and the wallet addresses provided in those requests. Preserve dates and original context rather than treating screenshots alone as verified identities.
Investigation approach
align messages with payment events; separate addresses mentioned in correspondence from addresses shown in transaction records; examine observable transfers within the agreed scope; distinguish apparent connections from any supported attribution. Multiple wallets do not by themselves establish common ownership.
Possible deliverables and limitations
a proposed payment chronology and annotated relationship diagram could show where correspondence and transaction evidence align. Public-chain data alone may not identify a person, reveal all activity or establish control of an address. Apparent connections would be clearly qualified, and no attribution or recovery is promised.
Practical next steps
retain original communications, verify claimed identities through independently established channels and consider reporting options supported by the evidence. Avoid presenting suspicions as established findings.