What can a payment-link record prove?¶

A payment-link record can show that a payment request was created, shared, opened or used within a provider’s system.

Avoid the dangerous assumption¶

The dangerous assumption is that the record proves the intended recipient personally created the link or that the payer completed the transaction.

The provider may record the account that generated the link, payment-request ID, amount, currency, description, creation time, expiry, recipient account and status.

It may also hold access timestamps, IP addresses, devices, browser information and linked transaction references.

The record can help establish what the user was invited to pay and which provider account was configured to receive the funds.

It may show whether the link was opened, expired, cancelled, paid, refunded or reused.

But opening a link is not the same as paying.

A completed status should be checked against the underlying bank, card, wallet or processor transaction.

The account that created the link may be shared, compromised or controlled by another person.

The payment description may also be entered by the creator and may not reflect the true purpose.

Preserve the full link, provider record, payment-request ID, status history and linked transaction identifiers.

Ask the provider for account, access, device, authentication and payout records.

Compare the link with the message in which it was sent, the payer’s device, communications and final movement of funds.

Do not describe the creator account as the person who created the link unless the wider evidence supports attribution.

When reporting, separate link creation, access, payment completion and final receipt.

Operational takeaway¶

Use payment-link records to prove the provider request and its status, then corroborate who created it, who paid and where the money ultimately went.