Could a payment application remain active on several devices?¶

Yes. One account can have several registered endpoints and simultaneous sessions, so finding one logged-in phone does not account for every transaction.

Devices, sessions and notifications are different¶

An old phone, replacement handset, tablet, browser or watch may remain authorised. A registered device may have no active session, while a browser session may persist separately. Notifications can synchronise to an endpoint that did not initiate or approve the payment.

Providers may record endpoint lists, session IDs, logins, IP-related data, token information, authentication and removals. The categories and retention periods vary.

Link the event to an access route¶

Preserve device and session history before security changes where possible. Compare transaction time with session, authentication and endpoint activity and ask whether initiation and approval can occur on different devices.

Multiple devices can be legitimate. State which endpoints were associated and what evidence, if any, connects the disputed event to one of them.