What evidence may corroborate payment authorisation?¶
Payment authorisation should be corroborated by evidence showing how the instruction was created, approved and linked to the relevant account or user.
Avoid the dangerous assumption¶
The dangerous assumption is that a completed transaction or successful authentication proves informed personal authorisation.
Useful provider evidence may include transaction instructions, authentication method, one-time-code delivery, biometric result, PIN use, device ID, session ID, IP address and timestamp.
Beneficiary creation, address whitelisting or payment-limit changes may form part of the sequence.
Device evidence may show the banking or wallet application, transaction details, notifications, copied account details, QR codes or messages.
Communications may show the payer discussing the transaction, confirming the recipient or being instructed by another person.
CCTV or location evidence may assist where a physical card, ATM or merchant terminal was involved.
Look at the full sequence, not merely the final confirmation screen.
A payment may be initiated on one device and approved on another.
A one-time code may be intercepted or disclosed.
Biometric approval may show successful device authentication without identifying the person beyond doubt.
Remote-access software may allow another person to guide or control the transaction. Communications may also show that the payer was deceived about the recipient, purpose or urgency.
Preserve all relevant timestamps and establish what each one represents.
Do not rely on one authentication event in isolation. Check whether the beneficiary, device or payment limit changed shortly before authorisation.
When reporting, distinguish transaction completion, technical authentication, personal authorisation and informed consent.
Operational takeaway¶
Corroborate payment authorisation through the transaction, authentication, device, session and communication sequence, and keep informed consent as a separate evidential question.