What should be recorded before an account is frozen or secured?¶

Before an account is frozen, secured or altered, record the volatile information that may disappear or change.

Avoid the dangerous assumption¶

The dangerous assumption is that all relevant account, device and transaction records will remain visible after security action.

Record the provider, account ID, registered name, email address, phone number, user ID and verification status.

Capture current balances, assets, pending transactions, recent payments, beneficiaries, linked cards or bank accounts, withdrawal addresses and transaction references.

Preserve registered devices, active sessions, login history, IP addresses, authentication methods, security alerts and recent account changes.

Record the date, time, device, network state and whether the account was already authenticated.

Capture any restriction message, fraud warning, support conversation or notification.

Where cryptocurrency is involved, preserve the network, asset, wallet addresses, transaction hashes and exchange references.

Do not move funds, test transactions or remove devices merely to see what happens.

If urgent action is required, record the authority, reason, decision-maker and sequence of actions.

Screenshots should show the full context, but provider exports or formal records may be more complete. Record any displayed timezone, pending status, available balance and restrictions because those details may change after formal intervention.

Do not assume that a later provider response will reconstruct the exact customer-facing state.

Some data may be overwritten, normalised or omitted.

When reporting, identify what was recorded before intervention and what changed afterwards.

Operational takeaway¶

Create a complete pre-intervention record of identity, balances, transactions, beneficiaries, devices, sessions and security state before freezing or securing the account wherever operationally possible.