Could revoking a payment device destroy useful session evidence?¶

Yes. Revocation may remove a device from the visible list, terminate its token and trigger alerts, obscuring evidence of registration, recent activity and session state.

Historical provider logs may not mirror the live view¶

Before removal, preserve internal device and session IDs, names, operating systems, IP-related data, authentication, login history, registration and last-seen times and links to disputed transactions. Ask the provider to retain historical records.

Protect against harm deliberately¶

Continuing fraud can make immediate revocation necessary. Do not preserve access at the cost of further loss, but identify victim, investigator and suspect routes before removing everything and record the decision.

Report what was captured live, what intervention changed and what the provider later supplied.