Who this is for
This is business-side work. The audience for the output is usually not the person commissioning it — it is their insurer, their counsel, or their bank.
- Companies about to transact with a counterparty they cannot fully verify
- Finance teams that have paid an invoice which turned out to be fraudulent
- Boards and counsel who need an independent account rather than an internal one
- Anyone preparing a claim where the insurer will question the timeline
Before a transaction
Verification of the entity, its ownership structure and its trading history against registries and filings; litigation history and adverse media; and an assessment of whether a counterparty's stated position matches the documentary record. The output is a written view of what is verified, what could not be verified, and where the residual exposure sits — because the unverifiable parts are usually where the risk actually lives.
After a loss
Business email compromise and misdirected-payment matters turn on a timeline. Establishing when access was first obtained — frequently well before the invoice that triggered the loss — routinely changes an insurer's position on a claim, because it changes the question from negligence at the moment of payment to a compromise that preceded it. Reconstructing that sequence, with artifacts that support each step, is the core of the work.
Built for the next reader
Almost all of this work exists to be given to somebody else. It is structured for that reader: methodology stated, source reliability marked, exhibits attached and referenced, conclusions separated from inference. The practical test we hold it to is whether counsel can file it or an insurer can assess it without having to rebuild it first.
Limits and legal considerations
We document what happened and where value moved. We do not recover funds, and we do not represent that tracing leads to recovery — that decision sits with banks, exchanges, law enforcement and the courts, and frequently the answer is no. Diligence also reports on the record as it exists: a counterparty with no adverse history may simply be new, or may be careful, and a clean report is not a warranty about future conduct. Where the work touches individuals for employment or credit purposes it becomes FCRA-regulated and needs a different process, which we will tell you at intake rather than after.
Questions people ask first
We have already sent the money. Is it too late?
Not necessarily for documenting it, which is what determines your position with the bank and the insurer. Whether funds can still be frozen depends on how far they have travelled and how quickly the institutions involved are notified — that part is urgent and is not something we control.
What will our insurer actually want?
In our experience: when access was obtained, how, what was accessed, and the payment trail — with artifacts supporting each point rather than a narrative. Establishing that a compromise predates the fraudulent invoice is frequently the single most consequential finding in the whole matter.
How far back can you establish access?
As far as the retained logs allow, which varies by provider and configuration. Some retain months, some retain far less. This is why the first advice in a live incident is to preserve logs immediately and change nothing before they are captured.
Can you do this discreetly, without alerting staff?
Usually. Where a matter involves possible internal conduct, scope and communications are agreed with you at the outset so the examination does not itself signal that it is happening. Say so at intake if that is a concern.