I have been given a payment record. What happens next?¶
A victim paid £1,850 as a deposit for a motorbike advertised online. The seller vanished and the bank statement shows a completed transfer to an account ending 4219. The payment is not simply proof of loss: it is a recorded route from the victim, through financial accounts and onward towards a suspect or suspects.
The sending record explains what left the victim’s account. The receiving and onward records explain what happened next.
Preserve the transaction in context¶
The victim supplies a screenshot showing £1,850 completed. Retain the original statement, application record or provider export where possible, together with the messages containing the payment instructions. Record who supplied it, how it was obtained and the relevant time zone.
TX-8842194219BIKE27The reference BIKE27 also appears in the seller’s message at 14:01:44 UTC. That joins the communication to the payment without requiring either record to do the other’s job.
Work the money route¶
01 · Fix the payment stage and the useful times
The victim authorised the transfer at 14:07:31 UTC; the receiving institution credited it seconds later.
Payment records may describe initiation, authorisation, processing, posting, settlement, reversal or refund. “Completed” on a customer screen should be understood using the provider’s terminology rather than treated as a universal technical state.
Preserve the provider’s original timestamp, time zone and sub-second precision where available. The payment time can be compared with the seller’s messages, receiving-account access and onward transfer.
A rounded date and amount may locate a transaction. Precise provider times allow the communication, receipt, login and onward movement to be tested as a connected sequence.
Go deeper: What is the difference between a pending and completed transaction? · What is a transaction reference?
02 · Identify the receiving account and preserve its records
The receiving account is held in Sam Dyer’s name and was opened eighteen days before the fraud.
A properly framed enquiry uses the transaction ID, receiving details, amount, currency, exact time and reference. Relevant records may include account opening, verification, linked contact details, access sessions, beneficiary creation, payment notifications and onward transactions.
BS-9921 · device BD-17Sam becomes a suspect because Sam’s account received the fraud proceeds and its registered device session rapidly moved them. That is stronger than the name alone, but it remains an evidential position to test.
03 · Trace onward movement before the trail grows cold
£1,600 moved to a payment account associated with Ellis Ward twelve minutes after receipt.
The payment provider identifies wallet account PW-882 as verified to Ellis Ward. It records access through the same handset installation associated with the false seller and messaging accounts.
Ellis is now a suspect in both the account-control and benefit lines. Sam remains a suspect in the receiving and onward-movement line. The convergence is evidentially important because independent providers place the two men in different parts of the same offence. The rapid onward transfer, Ellis-verified destination and shared device relationship form a strong circumstantial route from receipt towards control and benefit.
Go deeper: Why should the complete payment chain be identified? · What is the difference between movement of money and personal attribution?
04 · Separate the holder, user and beneficiary
Sam says the account was used without permission. That explanation can be tested against the account and device records.
The account was opened using Sam’s identity material and live image. Its registered handset BD-17 approved the onward transfer, and the £200 cash withdrawal used Sam’s physical card. Those facts do not make compromise impossible, but they give the investigation precise questions about possession, access and knowledge.
Communications show Ellis asking Sam shortly before the fraud whether “the new account is ready” and contacting him after the payment. The timing and content, considered with the registered device, card use and retained funds, provide a strong basis for testing whether Sam was an innocent account holder, a knowing participant or something in between. If the account is suspected of operating as a mule account, the relevant question becomes what evidence shows who controlled it and what that person knew.
Sam Dyer holds account ••4219The receiving institution’s customer records establish the account relationship.Whether Sam knowingly received and moved fraud proceedsAccess, card, communications and wider evidence test control, knowledge and intent.05 · Bring the money back into the wider investigation
The payment records connect Sam’s account to the victim and Ellis’s wallet; the marketplace, messaging and device records separately connect Ellis to the false seller.
The joined event sequence contains the seller’s instruction, victim’s authorisation, Sam’s receipt, the rapid onward payment and the cash withdrawal. Each event retains its own provenance, and each investigator remains accountable for the enquiries and decisions they made. Agreement on amount, reference, destination and time is powerful corroboration rather than duplication. The accounts and device identifiers allow further searches, interviews and provider enquiries to focus on who controlled each account and device, what Sam and Ellis knew, how the proceeds were divided and whether the same receiving route appears in other offences.
Where this leaves the investigation¶
TX-884219.