I have been given a payment record
Start with the transaction you can evidence, preserve its context and follow the recorded movement without assuming that an account name identifies the person who acted.
Start with what needs doing now
Use this route when a payment may require action, preservation or an early investigative decision.
Follow a realistic case from the first record through account access, onward movement and attribution.
Reference PAY-000Preserve firstBefore contacting a providerRecord the original material and volatile context before an account, device or session is changed.
Reference PAY-008Live account or applicationA payment session is already openDecide what must be recorded before navigating, closing the session or changing security settings.
Reference PAY-201Understand the evidence and the offender method
Use this route to understand what payment records mean, what they cannot prove alone and how offenders exploit payment systems.
Separate the recorded movement of value from control, knowledge and personal attribution.
Reference PAY-001Separate offender exampleDodgy Dave diverts an invoiceSee how invoice diversion, a mule account and onward transfers create several independent evidence sources.
Reference PAY-232Go directly to the issue you need to resolve
Keep the references that providers need to locate the event.
Reference PAY-006AttributionMoney movement is not personal attributionTest who controlled, caused, knew about or benefited from it.
Reference PAY-010Alternative explanationsCould the payment account be shared?Consider authorised, informal and unauthorised access.
Reference PAY-011SpeedCould useful records disappear quickly?Identify volatile records and act while they remain obtainable.
Reference PAY-207Browse every Payments and banking guidance page
The complete reference library remains available when you need a narrower question.- A payment, transaction or digital asset may be relevant to my investigation - where do I start?
- What can a payment record actually prove?
- What can a payment record not prove?
- Does a payment identify the person who made it?
- What is the difference between the account holder, payer, user and beneficiary?
- What is a transaction reference?
- What identifiers should be preserved from a payment record?
- What questions should I ask when someone reports a suspicious payment?
- What should I preserve before contacting a bank or payment provider?
- Why should the complete payment chain be identified?
- What is the difference between movement of money and personal attribution?
- Could a payment account be shared?
- Could a payment account have been compromised?
- Could a transaction have been automated or scheduled?
- What is payment authorisation?
- What is payment authentication?
- What is payment processing?
- What is settlement?
- What is the difference between a pending and completed transaction?
- What is a declined payment?
- What is a reversed payment?
- What is a cancelled payment?
- What is a refund?
- What is a chargeback?
- What does a transaction timestamp actually represent?
- Why might authorisation, posting and settlement times differ?
- Could time zones affect a payment timeline?
- Why might the payer and recipient records show different dates?
- What can a bank-account record prove?
- Does a bank account identify the person who controlled it?
- What is a bank transfer?
- What is a faster payment?
- What is a standing order?
- What is a direct debit?
- What is a scheduled bank payment?
- What is the difference between the sending bank and receiving bank?
- What is a beneficiary account?
- What is a sort code or routing identifier?
- What is an international bank account number?
- What is a SWIFT or BIC code?
- What is a payment reference entered by the customer?
- Does the payment reference prove the purpose of the transfer?
- Could the beneficiary name be misleading?
- What is confirmation of payee?
- Does confirmation of payee identify the actual user?
- What banking records should investigators request?
- What do bank login and device records contribute?
- Could one person operate several bank accounts?
- Could several people operate one bank account?
- What is a joint account?
- What is a business bank account?
- What is a nominee or third-party account?
- What can a card-payment record prove?
- Does a card payment prove that the cardholder made it?
- What is a card number?
- What is a payment token or tokenised card number?
- What is the difference between card-present and card-not-present activity?
- What is contactless payment?
- What is a chip-and-PIN payment?
- What is magnetic-stripe activity?
- What is a manual card entry?
- What is an online card payment?
- What is a recurring card payment?
- What is a card verification code?
- What does successful PIN use prove?
- What does a successful one-time passcode prove?
- Could a card be used without the physical card?
- Could a card payment be made through a mobile wallet?
- What is a merchant category code?
- What is a merchant descriptor?
- Why might the merchant descriptor differ from the shop name?
- What is an acquiring bank?
- What is an issuing bank?
- What is a card-payment processor?
- What card-payment records should investigators request?
- What can an ATM withdrawal record prove?
- Does an ATM withdrawal prove who collected the cash?
- What records may an ATM retain?
- Could CCTV and ATM records show different times?
- What is a cash-deposit machine record?
- What can a cash deposit prove?
- Could another person deposit money into an account?
- What is cashback at a merchant?
- What evidence may connect physical cash activity to a person?
- What records might a merchant hold?
- What records might a payment processor hold?
- What is an order ID?
- What is a merchant transaction ID?
- What is a payment gateway?
- What is a checkout session?
- What can billing information prove?
- What can delivery information prove?
- Does an invoice prove that payment was made?
- Does a receipt identify the purchaser?
- Could one payment relate to several goods or services?
- Could several payments relate to one order?
- What is a split payment?
- What is a marketplace payment?
- What is an escrow payment?
- What should investigators request from an online marketplace?
- Could a merchant account have been compromised?
- What is an online payment account?
- What can an online-wallet record prove?
- Does a digital-wallet account identify the user?
- What is the difference between a wallet balance and a bank balance?
- What is a stored-value account?
- What is a peer-to-peer payment?
- What is a payment handle or payment username?
- Could a payment handle be reassigned or changed?
- What is a linked funding source?
- Could one wallet use several cards or bank accounts?
- Could one card or bank account fund several wallets?
- What is a mobile-device wallet?
- What is device-tokenised payment?
- Does a biometric payment approval identify the person?
- What records might an online payment provider hold?
- What should be preserved from a payment application?
- Could a payment application remain active on several devices?
- Could an attacker add a new payment device or session?
- What is a payment link?
- What can a payment-link record prove?
- Could a payment link redirect to another service?
- What is a payment QR code?
- Does scanning a QR code prove that a payment was made?
- Could a QR code have been replaced or manipulated?
- What is a gift card?
- What is a digital voucher?
- Can gift cards be traced?
- What records might a gift-card provider hold?
- Does possession of a gift-card code prove purchase?
- Could several people use the same voucher or code?
- What is prepaid value?
- Why are gift cards and vouchers attractive in fraud?
- What is a money mule?
- Does receiving stolen money prove knowledge of the fraud?
- What is a mule account?
- Could a mule account also be a victim account?
- What is layering?
- What is rapid movement of funds?
- What is a pass-through account?
- What is account hopping?
- What is structuring or smurfing?
- What can repeated small payments indicate?
- Could legitimate activity resemble laundering?
- How should fund movement through several accounts be mapped?
- How should investigators distinguish traceability from culpability?
- What evidence may show control of a mule account?
- When should specialist financial investigation support be sought?
- What is cryptocurrency?
- What is a blockchain?
- What can a cryptocurrency transaction actually prove?
- What can a cryptocurrency transaction not prove?
- What is a wallet address?
- Does a wallet address identify a person?
- What is a private key?
- What is a seed phrase?
- What is a cryptocurrency wallet?
- What is the difference between a wallet and an address?
- What is a custodial wallet?
- What is a non-custodial wallet?
- What is an exchange account?
- What is a transaction hash?
- What is a blockchain explorer?
- What does transaction confirmation mean?
- What is a network fee?
- What is a token?
- What is a stablecoin?
- How can cryptocurrency movement be traced?
- Does following funds identify the person responsible?
- What is address clustering?
- What is a change address?
- What is a deposit address?
- What is a withdrawal address?
- Could an exchange reuse or rotate addresses?
- What records might a cryptocurrency exchange hold?
- What should be preserved from an exchange account?
- What can know-your-customer records prove?
- Could an exchange account be controlled by another person?
- What device and login records may assist cryptocurrency attribution?
- What evidence may connect a wallet to a device?
- What evidence may connect a wallet to a person?
- What is a hosted wallet transaction?
- Could an internal exchange transfer be absent from the public blockchain?
- What is a cryptocurrency mixer?
- Does use of a mixer prove criminal intent?
- What is a blockchain bridge?
- What is a token swap?
- What is a decentralised exchange?
- What is a cross-chain transaction?
- Why can funds appear to disappear between blockchains?
- What is a privacy coin?
- What is a coinjoin transaction?
- What is chain hopping?
- Could automated trading complicate a transaction trail?
- What evidence may remain after funds pass through a mixer or bridge?
- When should specialist cryptocurrency tracing support be sought?
- What payment evidence may exist on a mobile device?
- What payment evidence may exist on a computer?
- What evidence may exist in browser history?
- What payment evidence may exist in email or messaging accounts?
- What payment evidence may exist in cloud storage?
- What should be preserved from a live banking or payment session?
- Could opening a payment application alter the evidence?
- Could changing a password alert another user?
- Could revoking a payment device destroy useful session evidence?
- Could a payment provider freeze or restrict an account?
- What should be recorded before an account is frozen or secured?
- Could payment records disappear quickly?
- When should a provider preservation request be considered?
- What identifiers should be included in a provider request?
- What can payment records prove about an account?
- What can payment records prove about a device?
- What can payment records prove about a person?
- What evidence may corroborate payment authorisation?
- Could a payment account have been remotely controlled?
- Could a payment have been made by a family member or associate?
- Could a victim have been manipulated into authorising the payment?
- What is authorised push-payment fraud?
- Does authorisation prove informed consent?
- Could malware or remote-access software initiate the payment?
- Could a merchant or provider record be wrong?
- How should alternative explanations for payment activity be assessed?
- How should a payment record be described in an investigative report?
- How should bank-account attribution be worded?
- How should card-payment evidence be worded?
- How should cryptocurrency evidence be worded?
- How should uncertainty about account control be reported?
- How should movement of funds be distinguished from benefit or ownership?
- How should payment screenshots be presented evidentially?
- What are the most common mistakes in payment investigations?
- When should a payment line of enquiry stop?
- What is the overall investigator checklist for money, payments and digital assets?
- Dodgy Dave diverts an invoice