Does a payment identify the person who made it?¶

A payment can often be linked to an account, card, wallet or device. That is not the same as identifying the person who made it.

Avoid this assumption: The name attached to the payment is the user responsible for the transaction.

The account holder may have made the payment, but there are several realistic alternatives. Another authorised user may have operated the account. A family member or employee may have used the card. An offender may have compromised the account. A victim may have been persuaded to authorise the transfer. A payment may have been scheduled, automated or initiated through a merchant or payment service.

Start by identifying what the record actually attributes. Does it identify the sending account, the cardholder, the registered wallet customer, the merchant, the beneficiary or merely a payment instrument? Those are different evidential propositions.

Then look for evidence of control at the relevant time. Useful material may include login history, device registrations, IP addresses, authentication events, one-time-passcode records, beneficiary creation, session identifiers, mobile-wallet tokens and account-security changes.

Device evidence may show that a banking or wallet application was installed, accessed or used. Communications may show instructions, deception, coordination or knowledge. CCTV, location evidence, delivery records and witness accounts may help place a person with a device or at a physical payment point.

Even apparently strong authentication requires careful wording. Successful use of a password, PIN, biometric or one-time passcode may show that the required authentication step was completed. It does not automatically prove who completed it, whether credentials were shared, whether the device was remotely controlled or whether the user understood the transaction.

The best attribution case usually comes from convergence: account records, device records, authentication data, communications and contextual evidence pointing in the same direction.

Where the evidence remains incomplete, report the activity as associated with the account, card, wallet or device rather than asserting that the named person made the payment.

Operational takeaway¶

Attribute the transaction first to the account, instrument or service, and only attribute it to a person when corroborating evidence supports that conclusion.