What should be preserved from a live banking or payment session?¶

Record the authenticated context, account and complete transaction details, access routes and every investigator action before the volatile session ends or is changed.

Capture what was already available¶

Document endpoint, application or browser, account ID, displayed customer, time and network state. Preserve balances, transactions, beneficiaries, funding, devices, sessions, alerts and changes, including IDs, status, references and counterparties.

Balance preservation and safeguarding¶

Browsing and refreshing can create logs or change cache. Do not transfer funds, add beneficiaries, revoke sessions or change credentials without authority and a documented operational decision. Urgent loss prevention should record the evidence-versus-safeguarding balance.

Distinguish pre-existing display from information revealed by interaction. Screenshots support context; provider records and specialist capture establish completeness.