Identity theft prosecutions are built on digital evidence. The Crown's case typically rests on financial records, electronic device contents, IP address logs, and production orders compelling banks and telecommunications providers to disclose account and transaction data.
Police rarely make an arrest before completing a thorough documentary investigation. A production order (a judicial authorization compelling a bank, internet service provider, or phone company to disclose records) typically precedes any search warrant or arrest.
The search and seizure of electronic devices at the time of arrest produces the second category of evidence:
- phone contents
- laptop files
- browser history
- communications
Understanding exactly what evidence police gathered, when they gathered it, and under what legal authority is the first task in any identity theft defence.