What should be recorded before an account is frozen or secured?¶

Create a pre-intervention record of account identity, value, transactions, counterparties, access routes and security state that may change after action.

Capture the live account context¶

Record provider and user IDs, contacts and verification; balances and assets; pending and recent transactions; beneficiaries, linked funding and withdrawal addresses; endpoints, sessions, logins, authentication, alerts and recent changes. For cryptocurrency include network, contracts, addresses and hashes.

Document intervention boundaries¶

Note time zone, device, connection, authenticated state, available versus pending balance and displayed warnings. Do not test movement or remove access merely to observe effects.

If urgent action is required, record authority, reason, decision-maker and sequence. Preserve full-context captures and exports, then identify what changed and what formal provider records later supplied.