WIRE FRAUD · ELECTRONIC EVIDENCE

How Should Email and Portal Evidence Be Authenticated?

A printout shows what a file looks like today. Who sent it, what the portal displayed back then and whether anyone received it are separate questions.

By Heath Hyde · East Texas and statewide

Mr. Heath Enix ‘Heath’ Hyde
Eligible to Practice in Texas
Attorney at Law
Bar Card Number: 00796807
TX License Date: 11/01/1996

Primary Practice Location: Sulphur Springs, TX and Dallas, TX
214 Connally St Ste A
Sulphur Spgs, TX 75482-2612

Request a consultationCall 903-439-0000

Hypothetical: on May 9, a customer of a supply company wired $42,000 to a new bank account after an email from billing@. Months later the government’s exhibit for that wire is a two-page PDF of the message. Rule 901(a) requires “evidence sufficient to support a finding that the item is what the proponent claims it is.” Clearing that bar leaves authorship, hearsay, completeness and summaries for other rules.

Native files beat printouts

Each format answers a different question, and the gaps matter as much as the contents.

A PDF of the May 9 email proves almost nothing about who sent it, so the native file and the logs come first.

Shared accounts and automated messages

An email from billing@ is weaker proof of a person’s act than one from a named employee’s account. In the supply-company file, the portal sends a wiring email each time an invoice is approved. A rule generated the May 9 message. Nobody typed it that day.

That May 9 message carried the new payee account. It’s the charged wire. Three employees had approval rights, and the email doesn’t name the one who clicked. On May 2, someone edited the template, and the edit log may name that person.

I’d ask for the template history, the approval log for that invoice and the login records for the hour the message went out. The password list for billing@ belongs on that request too.

The foundation rules

Each rule answers one narrow question and leaves others open.

1. Rule 901(a) needs evidence sufficient to support a finding that the item is what the proponent claims. It leaves authorship and truth for later.
2. Rule 901(b) gives examples: testimony of a witness with knowledge, (b)(1); “distinctive characteristics,” (b)(4); and evidence of a process or system that “produces an accurate result,” (b)(9). None of them proves the record is complete.
3. Rule 902(13) allows a certification that a record was generated by an electronic process or system producing an accurate result. It says nothing about who wrote the content.
4. Rule 902(14) allows a certification that data was copied and checked by a process of digital identification, such as a hash value. It doesn’t show the copied data is true.
5. Both certifications borrow Rule 902(11)’s terms: “reasonable written notice” before trial and a chance to inspect the record and the certification. Hearsay objections survive.
6. Rule 803(6) covers a record made at or near the time by someone with knowledge, kept in a regularly conducted activity and made as a regular practice. The opponent may still show that the source or method indicates a lack of trustworthiness.

Summaries and completeness

Since December 1, 2024, Rule 1006 lets a court admit a summary of voluminous admissible records “whether or not they have been introduced into evidence.” The defense gets a reasonable chance to examine or copy the underlying records. A chart that only illustrates testimony falls under Rule 107.

For a government summary, I’d ask for the selection criteria, the duplicate-handling rule and the time zone used. If a different selection rule changes the total, the jury can hear it.

Rule 106, amended in 2023, lets a party require introduction of another part of a statement, or another statement, that in fairness ought to be considered at the same time. It applies over a hearsay objection, but only where the added material corrects a misleading impression. Compare the produced emails with the source system’s logs to find replies, drafts and follow-ups that were left out.

A request list for the discovery letter

• Native email files in their original format, with full headers and message IDs.
• Mail server logs and login records for the sending account, covering the day before and after each charged message.
• Portal exports, the user list with permission levels, and version history for the pages at issue.
• Approval logs and trigger rules for any automated message, plus the template’s edit history.
• The collection report: examiner, date, tool, hash values and any format conversions.
• Every 902(13) or 902(14) certification and the notice that went with it.
• The underlying data and selection criteria for each summary chart.

Time zones deserve their own line in the request. Mail servers often log times in UTC while a PDF export shows local time, so a 5:40 p.m. Central message in winter can appear as 23:40 in a log. Near midnight, that gap can move a message to a different day in a summary chart.

Common questions

Is a screenshot enough to authenticate a portal page?

It can meet Rule 901 if a witness explains how and when it was captured. It shows only the capture date. Proof of what a customer saw earlier usually comes from version history or deployment records.

Does a 902(13) or 902(14) certificate end the authentication fight?

It can replace a live authentication witness if the 902(11) notice and inspection requirements are met. Authorship, hearsay and meaning stay open for trial.