TxID isn't credibility at all. I can easily go find a 1.6 BTC transaction on BlockChain. Or send 1.6 BTC to one of my other addresses and fake a legitimate transaction.
It is if he can sign the address. But I doubt he can even come up with a TxID.
Yep. I posted a thread as precaution.
Check it out above.