Does an ATM withdrawal prove who collected the cash?¶

No. The record associates card or account with a machine event; a family member, associate or offender may possess the card and PIN.

Even successful security and dispense do not name a user¶

PIN verification shows accepted knowledge, and dispense shows machine action. Neither identifies the person. Issuer and operator times may also represent different stages.

Reconstruct the physical sequence¶

Obtain operator journal and issuer data and confirm full, partial, retained or reversed cash. Preserve CCTV quickly and compare card insertion or contactless use, PIN, authorisation, dispense and departure.

Use card possession, device location, travel, nearby purchases, vehicles, witnesses and communications to identify the person shown. Where unresolved, report the card/account event and visual limitations rather than assuming the holder attended.