What identifiers should be included in a provider request?¶

A provider request should include enough precise identifiers to locate the correct account, transaction and time period without unnecessary ambiguity.

Avoid the dangerous assumption¶

The dangerous assumption is that a person’s name or one screenshot is sufficient for the provider to find the relevant records.

Include the provider name and known account identifiers such as user ID, customer number, email address, phone number, payment handle or merchant ID.

For transactions, include transaction reference, order ID, payment-request ID, amount, currency, date, time, timezone, sender and recipient details and status where known.

For bank or card activity, include masked account or card details, sort code, routing identifier, IBAN, merchant descriptor, authorisation code or processor reference as available.

For cryptocurrency, include the asset, network, wallet addresses, transaction hash, exchange account ID, memo or destination tag and token contract address where relevant.

For access evidence, include the date range, known devices, IP addresses, sessions, authentication events and security changes sought.

Preserve identifiers exactly.

Do not shorten addresses, remove punctuation or substitute a display name for an internal ID.

Define the relevant time period and explain which timestamp is known.

Where several accounts or providers are involved, separate them clearly.

Do not overload the request with unverified identifiers without marking uncertainty.

Record the source of each identifier so errors can be checked.

When reporting, identify which records were requested against which identifiers.

Operational takeaway¶

Build provider requests around exact account, transaction, device and time identifiers so the provider can locate the right records and the resulting evidence can be reconciled reliably.