Using Communication Mapping to Investigate Fraud Networks

Fraud rarely operates in isolation. While lone employees occasionally divert payments or falsify expense claims, substantial corporate frauds, such as bid-rigging cartels, corrupt procurement rings, and sustained false-invoicing schemes, depend on collusion. Co-conspirators must negotiate terms, leak confidential tender thresholds, approve bogus purchase orders, and arrange illicit kickbacks. They leave operational traces across enterprise messaging platforms, email servers, and mobile devices. Yet, conventional investigation methods often fail to spot these networks because the conspirators purposefully distribute tasks across multiple individuals to avoid internal compliance thresholds.

Relying solely on linear document reviews and rigid keyword searches leaves investigators exposed to blind spots. Sophisticated fraudsters avoid explicit search terms such as bribe, secret, or kickback. They rely on coded language, innocuous meeting requests, or abrupt transitions to external communication channels. Communication mapping, also known as relationship or link analysis, shifts the focus from what suspects are saying to who they are speaking with, how often, and at what crucial moments. By graphing transactional communication metadata into structural networks, investigators can expose conspiratorial groups, isolate illicit bridge actors, and build robust evidence packs for civil recovery or criminal referral.

The Structural Anatomy of a Fraud Network

In a commercial organisation, legitimate business communications follow predictable hierarchies and operational pathways. Procurement managers speak with their immediate teams, category directors, and registered suppliers during open tender windows. Finance teams process batched invoices received through formal enterprise resource planning systems. Illicit networks, by contrast, create distinct anomalies within this organizational communication baseline.

When plotting communication flows across an organisation, three structural patterns typically indicate fraudulent collusion:

• The Isolated Clique: A tight cluster of internal employees who communicate frequently with each other and an external counterparty, but who deliberately bypass standard departmental channels. This pattern is common in procurement fraud, where an internal buyer coordinates directly with an unauthorised vendor while excluding technical evaluators.
• The Bridge Actor: An individual who occupies a structural bottleneck, connecting two otherwise separate groups. In payroll and false-invoicing schemes, the bridge actor is frequently a middle manager who maintains high-volume communication with external shell company directors while privately coordinating with junior staff in accounts payable to expedite approvals.
• The Shadow Channel: Sudden shifts in communication velocity or timing. Legitimate business communications predominantly occur during core working hours. A sudden surge of late-night messages, weekend emails, or uncharacteristically brief exchanges directing parties to move conversations to personal WhatsApp or Signal accounts often flags the coordination phase of an unlawful act.

Core Analytical Metrics: Centrality and Temporal Shifts

Visualising communication networks as nodes (individuals, accounts, or telephone numbers) and edges (the communications connecting them) allows forensic teams to apply objective mathematical metrics to massive data estates. Rather than guessing which custodians matter most, investigators evaluate three primary measures of network centrality.

Degree Centrality

Degree centrality measures the total number of direct connections a specific custodian maintains. While high in-degree or out-degree counts often denote department heads or administrative staff, unexpected degree centrality in junior employees frequently highlights unauthorized gatekeepers who distribute illicit instructions or triage illicit communications.

Betweenness Centrality

Betweenness centrality evaluates how often an individual falls on the shortest communication path between other pairs of actors. In complex bribery and corruption investigations, the mastermind rarely communicates directly with the entity paying the bribe. Instead, intermediaries route messages through corporate structures. Custodians with disproportionately high betweenness centrality are often bagmen or illicit facilitators who quietly broker corrupt arrangements.

Temporal Mapping and Event Correlation

Communication volume is rarely static. Overlaying communication velocity against commercial timeline milestones provides immediate context. By charting message frequency between suspect buyers and bidding contractors against specific corporate milestones - such as tender release dates, board approval meetings, and invoice submission windows - investigators can see whether communication spikes correlate with fraudulent execution. A spike of twenty text messages between a procurement lead and an external bidder thirty minutes prior to bid submission provides powerful circumstantial evidence of bid tampering, even before the message content is deciphered.

Communication Mapping Across the eDiscovery Workflow

Communication mapping is not an isolated exercise. It yields maximum value when integrated systematically across the Electronic Discovery Reference Model (EDRM) and structured disclosure exercises governed by frameworks such as Practice Direction 57AD.

Identification and Scoping

At the outset of an internal investigation, identifying the true custodian list is notoriously difficult. If investigators rely solely on organizational charts, they risk omitting key conspirators. Early communication mapping across corporate mail servers and mobile device call logs identifies unknown external entities and peripheral staff who maintain frequent contact with prime suspects, ensuring critical evidence is not overlooked.

Preservation and Collection

Data mapping reveals which platforms suspects actively used. If email exchanges between suspects show an abrupt drop in volume while contemporaneous call logs or calendar entries spike, investigators must immediately target mobile devices, personal devices under bring-your-own-device policies, and messaging archives. Applying targeted forensic collection early prevents spoliation and ensures compliance with the ACPO Good Practice Guide for Digital Evidence.

Processing and Normalisation

Real-world communication data is messy. Suspects communicate through multiple email aliases, display names, mobile numbers, and messaging handles. During data processing, forensic analysts must merge these fragmented identities into unified master entities. Without thorough identity normalisation, communication link charts become fractured, distorting centrality metrics and obscuring true relationship weights.

Review and Analysis

Using relationship visualisations within review platforms fundamentally alters review prioritization. Instead of evaluating documents chronologically, legal teams apply analytics to prioritize the edges of the network that connect internal suspects directly to illicit third parties. Documents situated along these anomalous connection lines can be batched into prioritized review sets, drastically reducing review costs and surfacing key documents in days rather than months.

Practical Methodology: Step-by-Step Investigation Checklist

Executing an effective communication mapping exercise requires systematic handling to protect evidential integrity. Legal and forensic teams should apply the following sequential workflow:

• Define the Target Scope: Identify the suspected fraudulent mechanism, the core transactional entities, and the relevant timeframe, incorporating a baseline period prior to the suspected misconduct to allow comparative analysis.
• Extract and Ingest Metadata: Harvest communication metadata from relevant sources, including Microsoft 365 logs, internal unified communications systems, mobile call data records, and email archives. Preserve all underlying message headers and routing data.
• Execute Entity Resolution: Normalise corporate directory names, variations in email addresses, external domains, and phone numbers into single custodian records to prevent duplicate nodes.
• Filter Commercial Noise: Strip out system-generated automated emails, marketing blasts, broad corporate newsletters, and calendar invitations that artificially inflate degree counts and obscure human interactions.
• Establish the Organisational Baseline: Map standard communication volumes between departments to identify typical institutional traffic patterns before searching for anomalies.
• Run Anomaly and Clustering Algorithms: Isolate communication clusters with high density, identify bridge nodes showing anomalous betweenness centrality, and isolate communications occurring outside standard working hours.
• Correlate with External Transactional Logs: Import finance data, enterprise resource planning timestamps, supplier bank payment dates, and security gate access logs to cross-reference communication spikes against commercial activity.
• Generate Evidence-Grade Link Charts: Export high-resolution, reproducible visual charts accompanied by underlying statistical tabular logs for integration into formal witness statements or forensic reports.

Evidential Integrity, UK GDPR, and Court Admissibility

Visual network charts are compelling in legal proceedings, but they must withstand rigorous scrutiny from opposing counsel, regulatory bodies, and the courts. An attractive chart that cannot be verified against underlying data will be dismissed as speculative.

To ensure link analysis is admissible in English civil proceedings under the Civil Evidence Act 1995 or for criminal referral to the Serious Fraud Office (SFO) or police, investigators must maintain a clear, unbroken audit trail. Every node and edge displayed in a presentation chart must tie directly to verified, forensically acquired source records. The methodology applied to normalise entities and strip automated data must be fully documented and reproducible by an independent forensic expert.

Data protection and privacy requirements under the UK GDPR and the Data Protection Act 2018 demand careful consideration. Bulk extraction and mapping of employee communications capture vast amounts of personal and sensitive data. Investigators must document a clear lawful basis, typically legitimate interests, and conduct a robust Data Protection Impact Assessment (DPIA) or Legitimate Interests Assessment (LIA) before mapping internal networks. Scoping must be strictly proportionate to the fraud under investigation. Sweeping enterprise-wide surveillance without demonstrable cause risks regulatory censure and can jeopardize the admissibility of internal findings in subsequent employment tribunals or civil litigation.

When executed rigorously, communication mapping transforms chaotic corporate data into clear, objective representations of human collusion. By exposing the hidden relationships that facilitate commercial fraud, legal advisers and forensic teams can isolate conspirators, secure freezing injunctions, and present conclusive evidence to courts and enforcement authorities.