A payment trail is the financial record left by a transaction, transfer, or series of related payments. It can include bank entries, processor logs, wallet movements, invoices, receipts, and correspondence that links money to a specific event or recipient.
In cyber security, payment trails matter because criminals still leave financial evidence even when they hide technical traces. Ransomware and extortion operations often depend on payments, and those records can help investigators connect wallets, accounts, intermediaries, and negotiating channels. Defenders use payment trails to support incident response, fraud review, legal action, and sanctions or compliance checks. A clear trail can also reveal whether a demand was paid, whether funds were moved through multiple hops, and whether related victims share the same infrastructure or criminal group.