Could a payment account have been remotely controlled?¶

Yes. A payment account may be operated through remote-access software, screen sharing, compromised sessions or another person directing the account holder.

Avoid the dangerous assumption¶

The dangerous assumption is that activity recorded from the victim’s usual device proves the victim independently controlled the transaction.

Remote-access software can allow another person to view the screen, move the pointer, enter information or guide the user step by step.

An offender may also take over an authenticated browser or application session without creating a clearly unfamiliar login.

Provider records may therefore show the victim’s normal device, IP address and authentication.

That does not rule out remote control or manipulation.

Relevant device evidence may include remote-access applications, installation times, connection logs, permissions, call records, messages and screen-sharing activity.

Provider records may show new beneficiaries, unusual payments, security changes, one-time-code events and activity during the remote session.

The account holder may still have completed some steps personally while following instructions.

Establish who initiated the contact, what access was granted, what the user could see and what happened immediately before and after the payment.

Do not assume that the presence of remote-access software proves it was used for the transaction.

Compare timestamps and logs.

Likewise, absence of a known application does not exclude other forms of session compromise.

When reporting, distinguish the device used, the person physically present, the remote controller and the actions completed by each.

Operational takeaway¶

Test remote control by aligning provider, device, connection and communication evidence, especially where the transaction appears to come from the victim’s normal device or network.