Payments & Banking¶

232 investigator questions.

Use the list below or search the complete library.

• A payment, transaction or digital asset may be relevant to my investigation — where do I start?
• What can a payment record actually prove?
• What can a payment record not prove?
• Does a payment identify the person who made it?
• What is the difference between the account holder, payer, user and beneficiary?
• What is a transaction reference?
• What identifiers should be preserved from a payment record?
• What questions should I ask when someone reports a suspicious payment?
• What should I preserve before contacting a bank or payment provider?
• Why should the complete payment chain be identified?
• What is the difference between movement of money and personal attribution?
• Could a payment account be shared?
• Could a payment account have been compromised?
• Could a transaction have been automated or scheduled?
• What is payment authorisation?
• What is payment authentication?
• What is payment processing?
• What is settlement?
• What is the difference between a pending and completed transaction?
• What is a declined payment?
• What is a reversed payment?
• What is a cancelled payment?
• What is a refund?
• What is a chargeback?
• What does a transaction timestamp actually represent?
• Why might authorisation, posting and settlement times differ?
• Could time zones affect a payment timeline?
• Why might the payer and recipient records show different dates?
• What can a bank-account record prove?
• Does a bank account identify the person who controlled it?
• What is a bank transfer?
• What is a faster payment?
• What is a standing order?
• What is a direct debit?
• What is a scheduled bank payment?
• What is the difference between the sending bank and receiving bank?
• What is a beneficiary account?
• What is a sort code or routing identifier?
• What is an international bank account number?
• What is a SWIFT or BIC code?
• What is a payment reference entered by the customer?
• Does the payment reference prove the purpose of the transfer?
• Could the beneficiary name be misleading?
• What is confirmation of payee?
• Does confirmation of payee identify the actual user?
• What banking records should investigators request?
• What do bank login and device records contribute?
• Could one person operate several bank accounts?
• Could several people operate one bank account?
• What is a joint account?
• What is a business bank account?
• What is a nominee or third-party account?
• What can a card-payment record prove?
• Does a card payment prove that the cardholder made it?
• What is a card number?
• What is a payment token or tokenised card number?
• What is the difference between card-present and card-not-present activity?
• What is contactless payment?
• What is a chip-and-PIN payment?
• What is magnetic-stripe activity?
• What is a manual card entry?
• What is an online card payment?
• What is a recurring card payment?
• What is a card verification code?
• What does successful PIN use prove?
• What does a successful one-time passcode prove?
• Could a card be used without the physical card?
• Could a card payment be made through a mobile wallet?
• What is a merchant category code?
• What is a merchant descriptor?
• Why might the merchant descriptor differ from the shop name?
• What is an acquiring bank?
• What is an issuing bank?
• What is a card-payment processor?
• What card-payment records should investigators request?
• What can an ATM withdrawal record prove?
• Does an ATM withdrawal prove who collected the cash?
• What records may an ATM retain?
• Could CCTV and ATM records show different times?
• What is a cash-deposit machine record?
• What can a cash deposit prove?
• Could another person deposit money into an account?
• What is cashback at a merchant?
• What evidence may connect physical cash activity to a person?
• What records might a merchant hold?
• What records might a payment processor hold?
• What is an order ID?
• What is a merchant transaction ID?
• What is a payment gateway?
• What is a checkout session?
• What can billing information prove?
• What can delivery information prove?
• Does an invoice prove that payment was made?
• Does a receipt identify the purchaser?
• Could one payment relate to several goods or services?
• Could several payments relate to one order?
• What is a split payment?
• What is a marketplace payment?
• What is an escrow payment?
• What should investigators request from an online marketplace?
• Could a merchant account have been compromised?
• What is an online payment account?
• What can an online-wallet record prove?
• Does a digital-wallet account identify the user?
• What is the difference between a wallet balance and a bank balance?
• What is a stored-value account?
• What is a peer-to-peer payment?
• What is a payment handle or payment username?
• Could a payment handle be reassigned or changed?
• What is a linked funding source?
• Could one wallet use several cards or bank accounts?
• Could one card or bank account fund several wallets?
• What is a mobile-device wallet?
• What is device-tokenised payment?
• Does a biometric payment approval identify the person?
• What records might an online payment provider hold?
• What should be preserved from a payment application?
• Could a payment application remain active on several devices?
• Could an attacker add a new payment device or session?
• What is a payment link?
• What can a payment-link record prove?
• Could a payment link redirect to another service?
• What is a payment QR code?
• Does scanning a QR code prove that a payment was made?
• Could a QR code have been replaced or manipulated?
• What is a gift card?
• What is a digital voucher?
• Can gift cards be traced?
• What records might a gift-card provider hold?
• Does possession of a gift-card code prove purchase?
• Could several people use the same voucher or code?
• What is prepaid value?
• Why are gift cards and vouchers attractive in fraud?
• What is a money mule?
• Does receiving stolen money prove knowledge of the fraud?
• What is a mule account?
• Could a mule account also be a victim account?
• What is layering?
• What is rapid movement of funds?
• What is a pass-through account?
• What is account hopping?
• What is structuring or smurfing?
• What can repeated small payments indicate?
• Could legitimate activity resemble laundering?
• How should fund movement through several accounts be mapped?
• How should investigators distinguish traceability from culpability?
• What evidence may show control of a mule account?
• When should specialist financial investigation support be sought?
• What is cryptocurrency?
• What is a blockchain?
• What can a cryptocurrency transaction actually prove?
• What can a cryptocurrency transaction not prove?
• What is a wallet address?
• Does a wallet address identify a person?
• What is a private key?
• What is a seed phrase?
• What is a cryptocurrency wallet?
• What is the difference between a wallet and an address?
• What is a custodial wallet?
• What is a non-custodial wallet?
• What is an exchange account?
• What is a transaction hash?
• What is a blockchain explorer?
• What does transaction confirmation mean?
• What is a network fee?
• What is a token?
• What is a stablecoin?
• How can cryptocurrency movement be traced?
• Does following funds identify the person responsible?
• What is address clustering?
• What is a change address?
• What is a deposit address?
• What is a withdrawal address?
• Could an exchange reuse or rotate addresses?
• What records might a cryptocurrency exchange hold?
• What should be preserved from an exchange account?
• What can know-your-customer records prove?
• Could an exchange account be controlled by another person?
• What device and login records may assist cryptocurrency attribution?
• What evidence may connect a wallet to a device?
• What evidence may connect a wallet to a person?
• What is a hosted wallet transaction?
• Could an internal exchange transfer be absent from the public blockchain?
• What is a cryptocurrency mixer?
• Does use of a mixer prove criminal intent?
• What is a blockchain bridge?
• What is a token swap?
• What is a decentralised exchange?
• What is a cross-chain transaction?
• Why can funds appear to disappear between blockchains?
• What is a privacy coin?
• What is a coinjoin transaction?
• What is chain hopping?
• Could automated trading complicate a transaction trail?
• What evidence may remain after funds pass through a mixer or bridge?
• When should specialist cryptocurrency tracing support be sought?
• What payment evidence may exist on a mobile device?
• What payment evidence may exist on a computer?
• What evidence may exist in browser history?
• What payment evidence may exist in email or messaging accounts?
• What payment evidence may exist in cloud storage?
• What should be preserved from a live banking or payment session?
• Could opening a payment application alter the evidence?
• Could changing a password alert another user?
• Could revoking a payment device destroy useful session evidence?
• Could a payment provider freeze or restrict an account?
• What should be recorded before an account is frozen or secured?
• Could payment records disappear quickly?
• When should a provider preservation request be considered?
• What identifiers should be included in a provider request?
• What can payment records prove about an account?
• What can payment records prove about a device?
• What can payment records prove about a person?
• What evidence may corroborate payment authorisation?
• Could a payment account have been remotely controlled?
• Could a payment have been made by a family member or associate?
• Could a victim have been manipulated into authorising the payment?
• What is authorised push-payment fraud?
• Does authorisation prove informed consent?
• Could malware or remote-access software initiate the payment?
• Could a merchant or provider record be wrong?
• How should alternative explanations for payment activity be assessed?
• How should a payment record be described in an investigative report?
• How should bank-account attribution be worded?
• How should card-payment evidence be worded?
• How should cryptocurrency evidence be worded?
• How should uncertainty about account control be reported?
• How should movement of funds be distinguished from benefit or ownership?
• How should payment screenshots be presented evidentially?
• What are the most common mistakes in payment investigations?
• When should a payment line of enquiry stop?
• What is the overall investigator checklist for money, payments and digital assets?