What records might a merchant hold?¶

A merchant may hold far more evidence than appears on the customer’s bank or card statement.

Avoid this assumption: The payment record alone explains what was bought, who ordered it and who received it.

Relevant merchant records may include customer-account details, order history, invoices, receipts, checkout sessions, billing information, delivery information, refund records, communications and staff notes.

For online transactions, the merchant may also hold IP addresses, device or browser information, account-login history, email addresses, telephone numbers and fraud-screening results.

For in-person payments, records may include terminal ID, till logs, staff operator details, receipts, CCTV, loyalty-account information and collection records.

The merchant may use a payment processor, marketplace or payment facilitator. Its own records may therefore use different references from the issuer or acquiring bank.

Preserve the merchant descriptor, merchant ID, order ID, transaction reference, amount, date, time and payment method.

Ask the merchant to explain how its order, payment and delivery records link together.

Do not assume that the billing name identifies the purchaser or that the delivery address identifies the beneficiary. Both can be copied, shared or deliberately false.

A merchant account may also have been compromised or used by another person.

Where goods were collected, identify who attended, what identification was shown and whether CCTV exists.

Where digital goods or services were supplied, seek account-access, download, redemption or usage records.

When reporting, separate payment acceptance, order creation, supply and receipt.

Operational takeaway¶

Obtain merchant order, account, payment, delivery and communication records so the transaction can be linked to what was supplied and who used or received it.