How should a payment record be described in an investigative report?¶

A payment record should be described by stating what the provider recorded, the relevant identifiers and the limits of the evidence.

Avoid this assumption: That shorthand phrases such as “the suspect paid” accurately reflect an account-based transaction record. Start with the provider, account or payment instrument, transaction reference, amount, currency, status and relevant timestamp.

Identify whether the time represents authorisation, processing, settlement, withdrawal or another event.

State the recorded sender, recipient, beneficiary or merchant details without assuming that the named person was the actual user.

Where access evidence exists, describe the associated device, session, IP address and authentication method separately.

Make clear whether the record is customer-facing, provider-supplied, merchant-generated or derived from another source. State the date obtained and any known limitations in the export or display.

Explain any reversal, refund, duplicate, pending status or later correction.

If attribution depends on other evidence, identify that evidence.

For example, say that the transaction was recorded against an account and that device and communication evidence supports the conclusion that a named person operated it.

Do not turn account ownership into personal authorship without explaining the link.

Avoid technical certainty where the provider record is incomplete or ambiguous.

Use exact identifiers and preserve the distinction between fact, inference and opinion.

Where relevant, state what the record does not prove, including informed consent, physical location or beneficial ownership.

Operational takeaway¶

Report payment evidence as provider-recorded account or instrument activity, then explain separately the evidence supporting user attribution, purpose, consent and benefit.