A fraud and asset tracing case
A worked fraud and asset tracing matter: preservation, banking and accounting records, communications review and evidence for a freezing order, with a timeline, what shapes the cost and the questions litigators ask.
A finance manager is suspected of routing supplier payments to companies he controls over three years. The client holds the accounting system, the banking records and the mailboxes, and needs to know the scale of the loss and where the money went before applying for a freezing order.
This page sets out what happens at each stage and the questions counsel ask before instructing. Fees are assessed case by case and quoted in writing.
§ Timeline
What happens, and when
- Day 1
Hold and quiet preservation
Preserve the mailboxes, laptop and accounting system exports without alerting the suspect, and freeze the audit trails in the finance system before month end housekeeping runs.
- Day 2 to 5
Collection
Forensic image of the device, tenant side mailbox export and a structured extract of supplier master data, invoices, approvals and payment runs.
- Week 2
Data analysis
Match supplier bank details to payroll and employee records, look for duplicated invoice numbers, round sum values, approval overrides and payments just under authorisation limits.
- Week 3
Communications review
Review the mailbox and chat material around each suspect payment, tying the transaction record to what was said at the time.
- Week 4
Loss schedule and evidence pack
A quantified schedule of suspect payments with supporting exhibits, in a form that can go behind a witness statement supporting a freezing or proprietary claim.
- Ongoing
Tracing and recovery support
Follow the funds through company records, land registry and, where crypto is involved, on-chain analysis, supporting disclosure applications against banks and exchanges.
§ Fees
What each stage covers
We do not publish rates. Every matter is assessed and quoted individually, because scope, data volume and urgency differ in every case. After the first call you get a written stage by stage quotation, and we do not move to the next stage without your approval.
| Stage | What it covers |
|---|---|
| Preservation and collection | Device imaging, mailbox export and finance system extract. |
| Structured data analysis | Supplier, invoice and payment testing with a documented rule set. |
| Communications review | Hosting, search term testing and reviewer support around the suspect transactions. |
| Loss schedule and exhibits | Quantified schedule, exhibit bundle and a statement of method. |
| Tracing support | Company, banking and on-chain tracing to support disclosure applications. |
| Expert report | Part 35 report and hearing attendance where quantum or method is disputed. |
§ FAQs
Questions counsel ask
- Can this be done without the suspect knowing?
- Yes. Mailbox, cloud and finance system preservation is done tenant side and leaves no visible trace on the user's device. Device imaging is timed for a period when the laptop can be taken without explanation.
- How quickly can we support a freezing order?
- A defensible first schedule of suspect payments is usually ready within two to three weeks. Where urgency demands it we can produce an interim schedule from the payments data alone in a few days.
- What if some of the money went into crypto?
- On-chain tracing runs alongside the conventional analysis, with exchange records obtained by disclosure application. Our crypto assets guide sets out how attribution is evidenced.
- What does a fraud investigation cost?
- Fraud work is quoted case by case, because the number of suspects, the years of payment data and the level of tracing required drive the effort. You get a written stage by stage quotation before we begin.
Financial services disputes →Crypto assets guide →Processing →
§ From the Case Builder blog
- Tracing crypto assets before the trail goes cold
How the first fortnight of a crypto tracing instruction runs in practice, from exchange notice to a witness statement a judge can follow.
- When a freezing order meets a private wallet
What a worldwide freezing order can and cannot reach when the money has left an exchange, and how to build the evidence that supports the application.
- The first 72 hours of a departing team case
Trade secrets and team move matters are decided by what is preserved before anyone is confronted. A practical order of work.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.