How do forensics identify a banking/financial fraud in a Windows system? Malwares usually uses realtime TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the financial system itself), which if not configured otherwise, theses connections are not logged anywhere. (As far as I know, you'd have to have some kind of network sniffing software running, like Wireshark). And so, how can forensics can safely determine if a transaction was indeed fraudulent? Usually, malware signatures at the time of their spread and actions are not detected by anti-virus applications, rendering them pretty much useless at the time of the fraud to either detect, prevent or log the illegal actions performed on such computers.

If that is so, are all users that makes use of online Windows based financial transactions fated to not receive any compensation in case of an eventual fraud in their computers? If that is not the case, how can it be achieved?

How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the financial system itself), which if not configured otherwise, these connections are not logged anywhere. (As far as I know, you'd have to have some kind of network sniffing software running, like Wireshark).

So, how can forensics determine if a transaction was indeed fraudulent? Usually, malware signatures at the time of their spread and actions are not detected by anti-virus applications, rendering them pretty much useless at the time of the fraud to either detect, prevent or log the illegal actions performed on such computers.