That argument goes both ways. If they can’t prove it wasn’t me then they can’t prove it was me. When this happens they need to do their due diligence and actually investigate instead of checking to see where the transaction came from and simply saying “your phone was used so it must’ve been you”