A fraud and asset tracing case
A worked fraud and asset tracing matter: preservation, banking and accounting records, communications review and evidence for a freezing order, with a timeline, indicative costs and the questions litigators ask.
A finance manager is suspected of routing supplier payments to companies he controls over three years. The client holds the accounting system, the banking records and the mailboxes, and needs to know the scale of the loss and where the money went before applying for a freezing order.
This page sets out what happens at each stage, what it costs and the questions counsel ask before instructing. The figures are indicative and exclude VAT.
§ Timeline
What happens, and when
- Day 1
Hold and quiet preservation
Preserve the mailboxes, laptop and accounting system exports without alerting the suspect, and freeze the audit trails in the finance system before month end housekeeping runs.
- Day 2 to 5
Collection
Forensic image of the device, tenant side mailbox export and a structured extract of supplier master data, invoices, approvals and payment runs.
- Week 2
Data analysis
Match supplier bank details to payroll and employee records, look for duplicated invoice numbers, round sum values, approval overrides and payments just under authorisation limits.
- Week 3
Communications review
Review the mailbox and chat material around each suspect payment, tying the transaction record to what was said at the time.
- Week 4
Loss schedule and evidence pack
A quantified schedule of suspect payments with supporting exhibits, in a form that can go behind a witness statement supporting a freezing or proprietary claim.
- Ongoing
Tracing and recovery support
Follow the funds through company records, land registry and, where crypto is involved, on-chain analysis, supporting disclosure applications against banks and exchanges.
§ Costs
What each stage costs
Indicative ranges for a matter of this shape, excluding VAT, court fees and your own review time. Every instruction gets a written stage by stage budget after the first call, and we do not move to the next stage without approval.
| Stage | Indicative fee | What it covers |
|---|---|---|
| Preservation and collection | £1,500 to £4,000 | Device imaging, mailbox export and finance system extract. |
| Structured data analysis | £3,000 to £8,000 | Supplier, invoice and payment testing with a documented rule set. |
| Communications review | £2,500 to £7,000 | Hosting, search term testing and reviewer support around the suspect transactions. |
| Loss schedule and exhibits | £2,000 to £5,000 | Quantified schedule, exhibit bundle and a statement of method. |
| Tracing support | £1,500 to £6,000 | Company, banking and on-chain tracing to support disclosure applications. |
| Expert report | £4,000 to £10,000 | Part 35 report and hearing attendance where quantum or method is disputed. |
§ FAQs
Questions counsel ask
- Can this be done without the suspect knowing?
- Yes. Mailbox, cloud and finance system preservation is done tenant side and leaves no visible trace on the user's device. Device imaging is timed for a period when the laptop can be taken without explanation.
- How quickly can we support a freezing order?
- A defensible first schedule of suspect payments is usually ready within two to three weeks. Where urgency demands it we can produce an interim schedule from the payments data alone in a few days.
- What if some of the money went into crypto?
- On-chain tracing runs alongside the conventional analysis, with exchange records obtained by disclosure application. Our crypto assets guide sets out how attribution is evidenced.
- What does a fraud investigation cost?
- A single suspect matter with three years of payment data typically runs between £10,000 and £25,000 through to an evidenced loss schedule. Scope and budget are agreed in writing stage by stage.
Financial services disputes →Crypto assets guide →Processing →
§ From the Case Builder blog
- Tracing crypto assets before the trail goes cold
How the first fortnight of a crypto tracing instruction runs in practice, from exchange notice to a witness statement a judge can follow.
- When a freezing order meets a private wallet
What a worldwide freezing order can and cannot reach when the money has left an exchange, and how to build the evidence that supports the application.
- The first 72 hours of a departing team case
Trade secrets and team move matters are decided by what is preserved before anyone is confronted. A practical order of work.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.