Could a victim have been manipulated into authorising the payment?¶

Yes. A victim may personally authorise a payment while acting under deception, pressure, impersonation or false instructions.

Avoid this assumption: That personal authorisation means the victim understood the true recipient, purpose and consequences. An offender may impersonate a bank, police officer, supplier, employer, relative, investment adviser or technical-support agent.

The victim may be told that the payment is needed to protect funds, verify an account, pay an invoice, release an investment or assist an investigation.

They may enter the payment details, pass authentication and confirm the transaction themselves.

Provider records may therefore show the victim’s normal device, IP address and successful authentication.

Those records prove the technical process, not informed consent.

Communications are often central because they reveal the explanation, pressure and instructions surrounding the payment.

Preserve calls, messages, emails, payment instructions, account details, scripts, warnings and any remote-access activity.

Establish what the victim believed, what was concealed and whether the recipient details changed during the interaction.

Look at the timing between communications, beneficiary creation and payment approval. Record warnings shown to the victim and what the offender told them to do about those warnings.

Do not describe the payment as voluntary without explaining the deception.

Equally, do not assume manipulation solely because the victim later regrets the payment.

Test the account against the communication and device evidence.

When reporting, distinguish personal action, technical authorisation, deception and informed consent.

Operational takeaway¶

Recognise that a victim can technically authorise a payment without informed consent and prove the manipulation through communications, timing, device activity and the false explanation given.