Six closed files, redacted. Names, dates and identifying detail have been removed permanently — what remains is the shape of each problem and the reasoning that closed it.
01
HD-2301-CCorporate Fraud · 4 months
The reconciliation that never reconciled
A manufacturer's margin was falling while volume rose. Internal audit found nothing. Was there a leak, or a bad model?
We rebuilt the procurement trail from purchase order to bank debit across eighteen months, then matched vendor entities against employee address and relationship data. Two intermediaries had been inserted between the company and suppliers it had used directly for years.
OutcomeScheme documented across multiple departments. Evidence handed to the client's counsel for recovery proceedings.
Digital ForensicsFinancial AnalysisDiscreet Interviews
A family lost contact with a relative travelling abroad on business. The consulate had opened a file. Nothing had moved in three weeks.
Digital footprint reconstruction gave us a last confirmed location that differed from the one on record. Working through a correspondent agency in-country, we established a movement pattern and identified the accommodation actually in use.
OutcomeIndividual located and safely returned to the family.
A family wanted a proposed match verified before committing. The presented history was detailed and internally consistent.
Verification to source rather than to document. Three of four claims held. The fourth — a professional qualification — traced to an institution not authorised to award it for the period claimed, which unravelled the stated employment history.
OutcomeClient informed with documentary support. Decision taken with full facts.
An insurer had a cluster of claims from one region sharing a medical assessor and a legal representative. Coincidence or pattern?
Lawful activity observation across a sample of claimants, logged to the minute, alongside a documentary review of the intermediaries common to the file set. The observation and the paperwork disagreed in the same direction every time.
OutcomeOrganised pattern identified and evidenced. Insurer's legal team took it forward.
A conservation body suspected a trafficking route was operating through an established transport corridor. No seizures had been made.
Market observation and consignment pattern analysis over five months built a network diagram: collectors, consolidators, transporters, and the single logistics operator whose paperwork made all of it look ordinary.
OutcomeIntelligence dossier delivered to the appropriate statutory authority for enforcement action.
A technology firm found data in the wrong hands and could not establish how it left. Their own logs showed nothing unusual.
Forensic imaging of the endpoints ruled out the assumed intrusion path. The actual entry was a compromised supplier mailbox and a payment-detail change nobody had questioned. We traced the account chain and documented the exfiltration window.
OutcomeEntry vector established, affected data scoped, remediation priorities issued alongside the report.
Case studies are marketing documents. Read them accordingly.
Every agency publishes its wins. What these files are actually for is showing you how a
problem gets decomposed — which question was asked first, what was ruled out, and where the
answer finally came from. If that reasoning does not look like it would survive contact with
your situation, that is useful information too.
We do not publish files that are live, that a client has not cleared, or that could be
re-identified from the detail we would need to include to make them interesting. That rules out
a fair amount of our better work.
Next step
Your case will not look like any of these.
It will have its own shape, its own dead ends and its own honest limits. The first conversation is where we find out what those are — at no charge.
