The number on the subpoena goes quiet. Maybe the phone was lost. Maybe it was a prepaid phone bought with cash and tossed. Maybe it was a company phone, handed back the day someone resigned. Three days later a number nobody has seen before starts calling the same sister, the same business partner, the same girlfriend and the same late-night contact the old phone called every week.
The phone changed. The people did not. That pattern is one of the most useful things a set of call detail records can show, and one of the easiest to overread. This post covers how investigators and litigation teams connect a known number to an unidentified replacement, what makes a match strong or weak, and how SentVi puts the evidence on one chart.
Where the question comes up
A replacement phone is not only a criminal investigation problem. It shows up across practice areas:
- Criminal investigations and defense: prepaid phones replaced on a schedule, where the subscriber name is blank or invented.
- Employee departures and trade secrets: the company phone comes back clean, and the conversations with the competitor moved to a personal line.
- Fraud recovery and asset tracing: a judgment debtor who stops answering one number and keeps doing business on another, sometimes registered to a relative.
- Insurance fraud: ring members who rotate phones between claims.
In each case the question is the same: is the new number the same person, and can you show it in a way that holds up?
What the records can and cannot show
As covered in Call Detail Records 101, a call record lists the number, the other party, the date and time, the duration, the direction, and often the cell site that handled the call. It does not say who was holding the phone. For prepaid lines the subscriber record often says nothing useful at all.
So the identification comes from behavior, and three signals carry most of the weight:
- Shared contacts. How many of the old number’s regular contacts also appear in the new number’s records, and how private those contacts are.
- Handoff timing. Whether the old number’s last activity and the new number’s first activity line up, with little or no period where both are active.
- Location continuity. Whether the new phone is served by the same towers the old phone used. As the cell site records post explains, a tower is an area, not an address, so this signal supports a match rather than proving one.
Finding the new number in the first place
Often nobody has the new number’s records yet, because nobody knows the number. The way in is usually through the people around it. The frequent contacts’ own records, where they are lawfully available, show calls to and from an unfamiliar number that starts appearing right after the known number stops. Once a candidate surfaces, its own records can be requested and tested against the old number.
That means the dataset arrives from several carriers in several formats. The three carriers post covers what has to happen first: time zones reconciled, number formats matched, and every record kept tied to its source.
How SentVi works the comparison
Start from what is known. With the records imported into one SentVi database, the analyst selects the old number and uses Get Links to show its direct contacts, then expands level by level to see the circle around it.
Test the candidate against it. Select both the old number and the candidate and use Get Links Between Selected, or the All Paths option with Entities Between, to see whether the two connect through the same people and how many paths join them. Filtering out unrelated calls isolates the community of interest, so the chart shows the overlap and nothing else.
Watch the handoff. SentVi’s timeline filtering and time range controls let the analyst step through the dates. On a clean replacement, the old number’s links fade out as the candidate’s links to the same contacts begin.
Check the network position. SentVi’s Social Network Analysis metrics run on the same chart. If the old number was a hub with high degree centrality, the replacement often takes over that position. Betweenness centrality shows which contact bridges the old and new groups, which is often the person to interview or depose next.
Map it. Plotting the cell sites for both numbers shows whether the new phone lives in the same area the old one did.
Show the work. The entity list exports to Excel, and diagrams and reports export as images, PDF or Word files for the report, the affidavit or the exhibit.
Strong match or coincidence
The same chart that builds a match is the one the other side will use to take it apart, so it has to show what does not fit as clearly as what does.
What strengthens a match:
- Overlap on low-volume, private numbers: a specific relative, a partner, an associate who talks to few other people.
- A clean handoff, with the new number starting within days of the old one going silent.
- The same towers at the same times of day.
- The same calling rhythm: who gets called first in the morning, who gets called late at night.
What weakens it:
- Overlap only on high-volume numbers that many people call, such as a family member everyone in the household calls, a business line, a pharmacy or a restaurant.
- Both numbers active at the same time for weeks, which can mean two people rather than one.
- Towers that do not match the old phone’s pattern.
- A household or workplace where several people share the same contacts.
For defense counsel, those weak points are the cross-examination. For the team building the case, they are the questions to answer before anyone else asks them. Either way, the analysis has to keep the full record, including the contacts that do not match, rather than a chart trimmed to the conclusion.
The subscriber name may say nothing. The calls usually say plenty.
A new phone breaks the link between a name and a number. It rarely breaks the link between a person and the people they call. Put the old number, the candidate and their contacts on one chart and one timeline, and the question becomes something both sides can see and test.
The video below shows SentVi working a set of call detail records from import to network.
Book a SentVi demo to see the analysis run on records like yours.
