Identity resolution and linking

Design an identity resolution and account-linking system for a marketplace where a single human may appear as multiple accounts, signed up with email, later with Google, later with a phone number, sometimes the same email at different times. You must merge these into one canonical identity for trust/fraud and personalization, without ever wrongly merging two different people (a catastrophic privacy/security failure). Scale: 500M identities, merges happen continuously. Discuss the data model, how you decide two accounts are the same person, and how you handle a bad merge.