Investigations · Evidence and analysis
Follow the information.
Keep the limits clear.
Fraud investigations may involve records from different sources. A careful process identifies the question, records what was reviewed and separates observations from interpretation and conclusions.
Explore investigative capabilitiesA structured approach
Questions first.
Conclusions last.
Work begins with what has been reported and what information is available. Depending on the defined scope, relevant records may be compared across communications, payment activity, public digital information and other sources.
Similar names, a transaction path or an online connection may be a lead to examine. It is not automatically proof of identity, ownership, intent or wrongdoing. Reports should make source and uncertainty visible.
How a fraud investigation may be scoped
Methods and information
Investigative capabilities
These pages describe possible areas of review. The work that is appropriate depends on available records, technical limits and the agreed question.
Digital evidence review
Organise relevant digital records, retain their source and context, and distinguish direct observations from interpretation.
Read about this method 02Transaction and fund-flow analysis
Compare documented payment records to build a cautious chronology of transfers and identify gaps for further enquiry.
Read about this method 03Blockchain transaction analysis
Review public transaction records on supported blockchains while separating observable activity from identity or ownership claims.
Read about this method 04Open-source intelligence
Collect and assess relevant public information with a record of its source, timing, relevance and limitations.
Read about this method 05Digital infrastructure analysis
Examine relevant public information about domains, websites and other digital infrastructure without treating technical similarity as proof of common control.
Read about this methodPublished work
Research & published investigations
Research reports are published when their sources and conclusions can be presented clearly. The index identifies available reports and makes no claim of client casework.
Visit the research indexEvidence. Clarity. Response.
A lead is not a finding.
Information can be incomplete, inaccessible or open to more than one interpretation. No investigation can guarantee identification, asset recovery or a particular decision by an institution or authority.