What is the overall investigator checklist for money, payments and digital assets?¶
The overall investigator checklist is designed to stop money, payment and digital-asset evidence being reduced to a balance, screenshot or account name.
Avoid this assumption: That once the money trail is visible, the person, purpose and evidential meaning are obvious. Start with the investigative question.
Identify what you need to establish: loss, payment method, recipient, account control, onward movement, benefit, recovery opportunity or links to wider offending.
Record the provider, account, card, wallet, merchant, exchange, asset, network and every relevant identifier.
Preserve transaction references, timestamps, timezones, amounts, currencies, fees, statuses, beneficiaries, wallet addresses and transaction hashes.
Separate the account from the payment instrument, device, session and person.
A registered holder is not automatically the transaction user.
A successful login or authentication event is not automatically informed consent.
Check whether the account was shared, compromised, remotely controlled or used under deception.
Preserve communications, devices, browser artefacts, cloud files, notifications and authentication records.
For cryptocurrency, confirm the correct network, token contract, address and transaction status.
Distinguish blockchain movement from wallet control, personal attribution and ultimate benefit.
Trace funds proportionately.
Identify internal provider transfers, refunds, reversals, conversions, cash withdrawals, exchanges, bridges and onward recipients.
Act early where records are volatile, funds may dissipate or provider preservation is required.
Document every investigative interaction that could alter an account, device or application.
Seek specialist support where complexity, live assets, recovery, legal process or attribution risk exceeds available expertise.
Report what each record proves, what it does not prove and what remains uncertain.
Operational takeaway¶
Preserve precise identifiers, separate accounts and devices from people, trace value proportionately, corroborate control and consent, and report only the conclusions the evidence can safely support.