Scams and payment fraud: reconstruct the scenario, trace the money
CEO fraud, a fake bank adviser, a bogus investment. Reconstruction of the scenario, tracing of the money flows and preparation of the file.
The situation
What happened
These frauds succeed through staging, not through technique. Reconstructing that staging is what makes it possible to contest and to recover.
A change of account
A known supplier announces a new account number by email, just before an important payment is due.
An instruction from the boss
An urgent, confidential transfer requested in the director's name, with orders not to mention it to colleagues.
A fake bank adviser
They know your recent transactions, warn you about fraud, and have you approve the transfers yourself.
An investment too good to be true
Guaranteed returns, an attentive contact, the first withdrawals honoured — and then nothing.
The decisive factor: speed. A transfer reported very early can sometimes still be blocked or recalled. Tell your bank first, then have what actually happened established.
The examination
What we establish, in practice
Emails, documents and logs are frozen, then analysed. The aim is twofold: understand how it got in, and document what can be put to the bank, the insurer or the court.
01
Authenticity of the emails
Full headers, look-alike domains, hijacked reply addresses, SPF, DKIM and DMARC checks.
02
Possible compromise
A hacked mailbox, a forwarding rule quietly created, remote access: telling plain impersonation apart from a real intrusion.
03
Reconstructing the scenario
A full timeline of the exchanges, the approvals and the phone calls, in a form that can be put to a third party.
04
Tracing the money
Receiving accounts, pass-through accounts, any conversion into cryptocurrency, and how far the trail goes.
05
Documents produced
Fake invoices, fake bank letters, forged identity documents: technical examination of the files and their metadata.
06
The report
Findings, method, SHA-256 hashes and chain of custody. Written for the bank, the insurer, the complaint or the proceedings.
Right now
Strictly avoid
- Waiting until the picture is clear before telling the bank.
- Deleting the fraudulent emails or emptying the bin.
- Reinstalling the machine concerned, or changing passwords from it.
- Calling back the number the fake adviser gave you.
Do this
- Tell the bank immediately and request a recall of the transfer in writing.
- Keep the emails with their full headers, without forwarding them.
- File a complaint, and record the transfer references.
- Warn the supplier or client whose identity was used.
How it unfolds
How the examination works
-
1
First conversation
You set out the facts, we say what has to be frozen today and what can wait.
-
2
Freezing the material
Copies of the emails, logs and machines concerned, with SHA-256 hashes.
-
3
Analysis
Authenticity, possible compromise, timeline and tracing of the money flows.
-
4
Report and next steps
Delivery of the signed report, support with the bank, the insurer or the proceedings.
Frequently asked
Frequently asked questions about payment fraud
Can the money be recovered?
Sometimes, and it is decided in hours rather than days. Beyond that, recovery depends on where the funds went and on cooperation between banks. We do not promise an outcome: we establish the facts that let you ask for one.
Was my mailbox hacked?
That is precisely one of the questions the examination answers. In many cases the address was merely imitated; in others there was genuine access, and that changes everything, including for the insurance.
The bank is holding me liable. What now?
Have the sequence of events established technically. A documented reconstruction, with headers and logs, carries far more weight than an account given in a letter of dispute.
Is it worth filing a complaint for a small amount?
Yes. Receiving accounts and scenarios recur across cases, and your complaint feeds investigations already under way.
Have what happened established
First conversation free and confidential. Tell your bank first, then call us.
- Professional secrecy
- Quote before any work
- Court-registered expert