Case file: two people, one shared login, one disputed purchase

This is a hypothetical case. Sam, Priya and the shop are invented to illustrate a pattern that comes up often. Any resemblance to real people or businesses is unintended.

Sam and Priya shared a flat and, to save money, a single account on a large online shop. The account had Sam's card saved, because Sam had set it up. Both used it for household items and split costs at the end of each month.

One evening, Sam found an order for a pair of premium headphones that neither of them had mentioned. Priya said she had not bought them. Sam had not either. The headphones had been delivered to the flat two days earlier and signed for with an illegible scrawl. When two people share one login, the account can no longer tell you who did what. That is where this case begins.

The timeline

• Day 0. Order placed from the shared account using the saved card.
• Day 2. Parcel delivered to the flat; signed for.
• Day 4. Sam notices the charge on the card statement and finds the order in the account.
• Day 4. Both deny placing it. The headphones are nowhere to be found.
• Day 5. Sam contacts the shop, then the card issuer.

The first problem: authorized or not?

The issuer's first question was whether the purchase was unauthorized. That turned out to be hard to answer. The order came from an account Sam had created, using a password Sam had shared, with a card Sam had saved, delivered to Sam's address.

From the issuer's point of view, Sam had given another person the means to make purchases. Many card terms treat purchases made by someone you allowed to use your card details as if you had made them yourself, even if you did not approve that specific one. The details vary, but sharing the login weakened Sam's position considerably.

The second problem: whose word?

Sam believed Priya. Priya believed someone else must have used the account. Possibly a third person had the password: a former flatmate, a visiting friend, or an attacker who found the password in a breach of another site where it had been reused.

The shop's records showed the order came from a browser and location consistent with the flat's internet connection. That narrowed things but did not settle them.

The evidence that existed

• the order record, with time, device type and delivery address;
• the delivery record, with a signature that matched nobody clearly;
• the account's sign-in history, which showed sign-ins from three different devices in the past month;
• the card statement entry.

The sign-in history was the most interesting part. One device was Sam's laptop, one was Priya's phone, and the third was unfamiliar.

What happened next

The shop agreed to investigate and, given the unfamiliar device, treated the account as possibly compromised. It reset the password, signed out all devices and opened a fraud review. The card issuer advised Sam that, because the card was saved in a shared account with a shared password, a chargeback for an unauthorized transaction was unlikely to succeed, and suggested waiting for the shop's review.

In the end, the shop refunded the order as a goodwill gesture after concluding the account had probably been accessed from outside. It did not identify who had done it. Sam and Priya never found the headphones.

What made this so difficult

• One login, two people. Nothing in the records could separate their actions.
• A shared password. It was also used on another site, which may have been the leak.
• A saved card. Anyone signed in could spend without entering card details.
• No second sign-in step. A stolen password alone was enough.

We listed the kinds of terms that put responsibility on the account holder in terms-of-service red flags. Clauses like "you are responsible for all activity under your account" are common, and they mean exactly what they say in cases like this one.

What would have helped

1. Separate accounts, even on the same shop, with separate payment methods.
2. Unique passwords, never reused across sites.
3. Two-step sign-in, so a password alone would not have been enough.
4. Regular checks of the sign-in history, which would have shown the unfamiliar device earlier.
5. Notifications for new orders, sent to both people if an account must be shared.

Why this matters for money accounts

A shared shopping account is an inconvenience when things go wrong. A shared account that holds money or card details is a much bigger problem. If a third person can sign in, they can spend, and the records cannot tell you who they were.

That is why our accounts are personal: one account per person, a mandatory second sign-in step that cannot be switched off, and a sign-in log you can read yourself. Card details appear only after a fresh code from the account holder's authenticator. Compare this case with the shop that vanished, where clear records made a dispute simple. The help center explains how to check your own sign-in history.

Sharing costs without sharing a login

Sam and Priya's goal was reasonable: split household spending fairly. There are ways to do that without one login. One person can place the order from their own account and send a request through a payment app for the other's share. Some services offer household or family plans with separate profiles and separate sign-ins under one bill, which keeps the saving and restores the records. A shared shopping list, kept in a notes app, lets both people add items without either needing the other's password.

Each of these keeps one simple property intact: every action in an account belongs to one identifiable person. That is what makes a dispute answerable when something goes wrong, and it costs almost nothing to set up.

Questions people ask

Is sharing an account against the rules?

Many services forbid it in their terms, and almost all make the account holder responsible for everything done under it.

Can I dispute a purchase made by someone I gave my password to?

Often not as an unauthorized transaction, because you gave them access. Contact the merchant first; it may help if the account was misused.

How do I see who has been using my account?

Many services show recent sign-ins and devices in the security settings. Check it regularly, and sign out devices you do not recognize.