What can payment records prove about a device?¶

Payment records can associate activity with a device identifier, application, browser or session, but that is not the same as proving who held or used the device.

Avoid the dangerous assumption¶

The dangerous assumption is that a device record identifies the device owner as the transaction user.

A provider may record device ID, operating system, browser, application version, device name, IP address, session ID and authentication method.

Those records can help distinguish access routes and show that a particular registered device or session interacted with the account.

They may also show when a new device was added, removed or used for a payment.

But provider device names can be user-selected, incomplete or generic.

A device may be shared, borrowed, stolen, remotely controlled or left with an active session.

Notifications may appear on one device even where another initiated the transaction.

An IP address may represent a household, mobile network, workplace, VPN or proxy rather than one device.

Preserve the provider’s internal device and session identifiers, not only the friendly name shown in the application.

Compare payment records with seized-device artefacts, application data, timestamps, communications and location evidence.

Look for transaction creation, authentication, confirmation or receipt on the device rather than presence of the application alone.

When reporting, state what the provider associated with the device or session and avoid identifying the human user without corroboration.

Operational takeaway¶

Use payment records to identify the device or session associated with account activity, then prove the user through device examination, possession, communications and surrounding evidence.