Does a digital-wallet account identify the user?¶

A digital-wallet account identifies the customer or profile registered with the provider. It does not automatically identify the person using it at a particular time.

Avoid the dangerous assumption¶

The dangerous assumption is that the registered name, email or phone number proves personal control of every transaction.

A wallet may be active on several phones, tablets, browsers or other devices.

Credentials may be shared, stored or compromised. An offender may use an existing authenticated session without changing the account details.

A family member, employee or associate may also have authorised access. The provider may not record which person was holding a shared device.

To assess the actual user, obtain login history, registered devices, IP addresses, session identifiers, authentication events, contact-detail changes and account-recovery records.

Look at when funding sources and recipients were added.

Device evidence can show whether the wallet application, account session or payment notifications were present. It may also reveal saved credentials, linked email accounts or remote-access software.

Communications may show permission, instructions, deception or knowledge.

Do not assume that a verified customer identity proves exclusive control. Verification usually relates to account opening or provider compliance, not every later transaction.

Likewise, do not assume that a new device proves compromise. It may reflect replacement, travel or legitimate additional access.

Compare disputed activity with the account’s normal devices, locations, recipients and transaction pattern.

When reporting, distinguish the registered customer from the person proven to have operated the wallet.

Operational takeaway¶

Treat wallet registration as evidence of the provider relationship and establish the transaction user through device, session, authentication and contextual evidence.