What payment evidence may exist on a mobile device?¶
A mobile device may contain payment evidence that is not available from a bank statement or provider response alone.
Avoid the dangerous assumption¶
The dangerous assumption is that finding a banking or wallet application proves the device owner made every transaction shown within it.
Relevant evidence may include installed banking, payment, exchange and wallet applications.
The device may hold account identifiers, transaction history, beneficiaries, payment requests, QR codes, wallet addresses, transaction hashes, notifications and security alerts.
Messages, emails, photographs and screenshots may show invoices, receipts, payment instructions, gift-card codes or cryptocurrency addresses.
Browser data may reveal merchant checkouts, exchange logins, payment links and account-recovery activity.
The device may also contain saved credentials, authentication applications, one-time-code messages, biometric settings and registered-device information.
Application data may be live, cached, synchronised or incomplete.
A displayed transaction may have been initiated on another device and merely notified here.
The account may also be shared, compromised or remotely controlled.
Preserve the device state and seek an appropriate forensic process rather than exploring applications casually.
Opening an application may create access logs, synchronise data, trigger authentication or alter local artefacts.
Record whether the device was locked, unlocked, online, offline or already displaying an authenticated session.
Do not move funds, test credentials or revoke access without considering evidential and safeguarding consequences.
Compare device artefacts with provider, bank, merchant and blockchain records.
When reporting, distinguish application presence, account access, transaction visibility and evidence of actual authorisation.
Operational takeaway¶
Use mobile-device evidence to link accounts, applications and transaction activity, but establish the actual user through provider, device, session and contextual evidence.