What evidence may exist in browser history?¶

Browser history can show access to payment services, merchant checkouts, exchange accounts and financial information relevant to an investigation.

Avoid the dangerous assumption¶

The dangerous assumption is that a visited page proves the user completed the transaction shown or intended the activity under investigation.

Useful artefacts may include visited URLs, page titles, timestamps, searches, downloads, cookies, form data, cached pages and active sessions.

The browser may show access to online banking, payment links, merchant checkouts, gift-card sites, cryptocurrency exchanges, blockchain explorers or wallet interfaces.

Downloaded statements, receipts, transaction exports and invoices may remain even where the web history has been cleared.

Cookies or session tokens may show that an account was authenticated, but they do not automatically identify the person who used it.

A page may have opened through an advertisement, message link, redirect or background process.

Browser timestamps may reflect page loading rather than payment authorisation.

Preserve the browser profile, history database, downloads, bookmarks, extensions and session data through an appropriate forensic process.

Do not rely only on the visible history list.

Private browsing, synchronisation and multiple browser profiles may affect what remains.

Compare browser activity with provider logs, transaction timestamps, device use, communications and authentication records.

Look for the sequence from search or message, through checkout or login, to confirmation or receipt.

When reporting, distinguish visiting a payment page, accessing an account, attempting a payment and completing a transaction.

Operational takeaway¶

Use browser history to reconstruct the route into payment activity, but prove completion and user control through provider, transaction, device and contextual evidence.