I think having suspicion would come into play in a number of different directions. They suspect it exists. They suspect it relates to wrongdoing. They suspect they might be able to find it. The example they gave is you crossed the border or you came into an airport and you had a very expensive purse and they think it's new and they think they might find the receipt for it on your phone.
I would assume what would inform their suspicion is whether you appear to be a savvy enough person to organize your receipts electronically. Would that exist? Is it a Nokia from 20 years ago or is it an iPhone from now? There are probably a whole bunch of variables that you could never necessarily put into a great flow chart, but these questions are dealt with by law enforcement across the country on a daily basis not just at the border.
I think there are ways these can be arrived at. One thing that's also worth noting just in a general context, is the courts have also said the border is not in a no-charter zone. They have said you have a reduced expectation of privacy, but the charter still applies at the border.