During a threat modeling session for a new online banking transfer feature, an analyst identifies a risk where a customer could initiate a fraudulent wire transfer and later deny having performed the action, and the application currently keeps no tamper-evident record of who authorized each transaction. Using the STRIDE framework, which threat category does this risk represent, and which control most directly mitigates it?