Fraud Investigations
Fraud investigation work sits at the intersection of security and old-fashioned detective work. Whether it's a business email compromise that resulted in a wire transfer to the wrong account, suspected insider manipulation of financial records, or a vendor relationship that doesn't add up, the goal is the same: figure out what actually happened, build a record that will hold up if it needs to go to law enforcement, counsel, or insurance, and then close the hole that let it happen.
Where this usually starts
Most of the fraud cases I get called into start with a number that doesn't match, a payment that went somewhere it shouldn't have, or a pattern someone noticed almost by accident. Business email compromise is the one I see most often — an attacker gets into an email account or spoofs one convincingly enough, inserts themselves into a real conversation about an invoice or a wire transfer, and redirects money before anyone notices the account details changed. Insider cases are different — usually a pattern that builds over time, uncovered through an irregularity in records, an access anomaly, or a tip.
How I work an investigation
I start by preserving evidence before anything else, because fraud investigations fall apart when logs get overwritten, emails get deleted in a cleanup, or systems get changed before the picture is clear. From there, I reconstruct the timeline — email headers and metadata, financial records, system and access logs, communications — to establish what actually happened and who or what was responsible. I'm careful about the line between what the evidence shows and what's speculation, because an investigation that overstates its conclusions doesn't hold up under scrutiny and can create real legal exposure.
Once the "what happened" question is answered, I turn to "how do we stop this from happening again" — usually payment verification procedures that would have caught a BEC attempt, access controls or segregation of duties that would have made an insider scheme harder to pull off, or detection that would have flagged the anomaly faster. A fraud investigation that doesn't end in a concrete prevention recommendation is only half done.
Who this is for
Organizations that have discovered a fraudulent payment or suspect one is in progress, companies dealing with suspected insider fraud, and anyone who needs a clear, defensible account of what happened for law enforcement, counsel, or an insurance claim.
If something doesn't add up, reach out and let's find out what actually happened.