How should alternative explanations for payment activity be assessed?¶

Alternative explanations for payment activity should be identified, tested against the evidence and recorded proportionately.

Avoid this assumption: That the first plausible account, device or person link is the only realistic explanation. Possible alternatives may include shared account use, family access, account compromise, remote control, automated payments, merchant error, duplicate processing, refund activity or victim manipulation.

For cryptocurrency, alternatives may include custodial provider control, address reuse, change addresses, internal transfers or shared wallets.

Start by stating the proposition that needs to be proved.

Then identify what the payment records directly show and what has been inferred.

Test each realistic alternative against provider access records, devices, authentication events, communications, timing, location, benefit and normal account behaviour.

Do not invent remote possibilities with no evidential basis.

The purpose is not to list every imaginable scenario.

It is to test reasonable explanations that could materially affect attribution, knowledge or intent.

Look for evidence that supports and contradicts each account. Record why an explanation was accepted, rejected or left genuinely unresolved.

A familiar device may support normal use but may not exclude remote control.

A new beneficiary may support deliberate setup but may also have been added under deception.

Record unresolved conflicts rather than smoothing them over.

Where evidence cannot distinguish between explanations, say so.

When reporting, identify why one explanation is better supported and what remains uncertain.

Operational takeaway¶

Assess realistic alternative explanations against the complete provider, device, communication and contextual evidence, and report unresolved uncertainty instead of overstating attribution.