What banking records should investigators request?¶

Request records matched to the question across four layers: customer relationship, financial events, account access and provider decisions. A statement rarely covers all four.

Define each evidential layer¶

Account records can identify holders, authorised users, contacts and linked accounts. Transaction data should preserve amounts, currencies, times, references, destinations, status changes and onward movement.

Attribution may require logins, IP-related fields, registered devices, sessions, authentication, one-time codes, beneficiary setup and security changes. Fraud warnings, risk decisions, support calls, secure messages and branch contact explain provider and customer response. Card enquiries can add merchant, terminal and token data; transfers may require full payment messages and intermediaries.

Target the relevant event¶

Supply stable account and transaction IDs, date range and issue. Ask for original fields, time bases and definitions, and consider retention early. Where several institutions hold different stages, obtain each source rather than expecting one bank to reconstruct the chain.