What evidence may connect physical cash activity to a person?¶

Cash activity is attributed by joining the financial event to a place, a person present, their devices or vehicles and what happened before and after.

Independent sources build the link¶

ATM or deposit journals, branch notes, slips, receipts and references establish system events. CCTV can show handling; endpoint location, travel, vehicles, communications and witnesses can connect a person. Recovered notes may add serial-number, packaging or forensic evidence where relevant.

Proximity is not participation, account holder is not necessarily the person shown, and a matching amount does not prove cash source.

Preserve each layer¶

Secure CCTV quickly and reconcile clocks. Record recovered denominations, quantity, packaging and handling. Build a sequence from account event through physical interaction to later meeting, purchase, deposit or possession, distinguishing observation from inference.