Systems, methods, and computer program products to perform an operation comprising receiving digital content associated with an account identifier, parsing the digital content and extracting a set of attributes from the digital content, receiving via a network connection, from each of a plurality of online identity services, a set of identities matching at least one attribute of the set of attributes, intersecting the sets of identities to create a set of candidate identities, computing a score for each identity in the set of candidate identities, wherein each score reflects a likelihood that the respective candidate identity is associated with the account identifier; and returning a ranked list of the scored candidate identities and an indication of at least one item of evidence linking the respective candidate identity to the account identifier.