A payment, transaction or digital asset may be relevant to my investigation — where do I start?¶

You have been given a bank transfer, card payment, wallet address, payment screenshot or transaction record.

Do not begin by trying to decide immediately who made the payment. Begin by identifying exactly what you have.

Avoid this assumption: A payment record is a complete account of what happened. It may show only one stage of a longer process. A screenshot may omit the transaction reference. A bank statement may show posting rather than authorisation time. A blockchain entry may show movement between addresses without identifying the people controlling them.

Start with five questions.

First, what kind of payment or asset is involved? It may be a bank transfer, card transaction, online-wallet payment, cash withdrawal, gift card, cryptocurrency transfer or another form of stored value.

Second, which services and identifiers are visible? Preserve account numbers in their displayed form, masked card details, wallet addresses, transaction hashes, merchant names, payment handles, dates, times, amounts, currencies and transaction references.

Third, what stage of the payment are you looking at? A payment may be pending, authorised, declined, reversed, refunded, settled or completed. Those terms are not interchangeable.

Fourth, who may hold further evidence? Relevant records may exist with the sending bank, receiving bank, card issuer, merchant, payment processor, exchange, wallet provider, device, email account or messaging service.

Fifth, what must be preserved now? Record the source of the material, capture the complete screen or document, retain the original file where possible and avoid altering a live account or application without considering the consequences.

Then separate two questions: where did the money or value move, and who was responsible for making it move? Those are related, but they are not the same.

Specialist financial or cryptocurrency support should be sought early where funds are moving rapidly, several providers or jurisdictions are involved, or attribution depends on technical tracing.

Operational takeaway¶

Identify the payment type, preserve every visible identifier and map the evidence holders before drawing conclusions about the person responsible.