The opening hours
What to stop, what to preserve and who to tell, decided in the order that protects the position.
Finance and crypto
Fraud response.
The hours after money or assets are found to be missing are the ones that decide what happens next. Almost everything important about a fraud is settled by what the business does before it has the full picture, and a great deal of the damage done in that period is self inflicted.
What this looks like when it goes wrong
The commonest first mistake is telling the wrong person. Somebody inside the business is asked to look into it, and that person is either involved or is close to whoever is. Warnings travel quickly. Assets that were sitting still start moving, and records that existed when the question was asked do not exist by the time anybody goes looking for them.
The next is a demand sent immediately. The instinct after discovering a loss is to confront, and a letter or a call hands the other side everything it needs: confirmation that you know, an indication of what you know, and time to prepare. The quiet routes that exist while nothing has been sent stop existing the moment something is.
Then there is the evidence nobody preserved. Devices are wiped and reissued, an account is closed, a leaver is offboarded in the ordinary way, and correspondence is deleted under a retention policy doing exactly what it was designed to do. None of this is done in bad faith. All of it is irreversible.
The last is silence where somebody had to be told. Insurers, banks, regulators and in some cases the people whose money or data was affected may have to be notified, and duties of this kind attach to some businesses and not to others. Failing to consider the question turns one problem into two, and the second is entirely of your own making.
What actually decides it
Containment comes before investigation. Whatever is still moving needs to be stopped before anybody starts working out what happened, which means access, authority and payment routes, and it usually means doing it in a way that does not tell the person responsible that anything has been noticed. The order of those two things is the most consequential decision anybody makes in the opening period.
Who is told is a decision, not an accident. A small group with a reason to be in it, a record of what has been shared and with whom, and one line on who speaks for the business. Where an employee may be involved, employment obligations run alongside everything else, and acting on suspicion without evidence creates exposure of a different kind.
Preservation is cheap now and impossible later. Records, devices, accounts and correspondence should be held in the state they are in, before anybody tidies. This is less a technical exercise than an instruction: stop the ordinary processes that destroy information, and be able to show what was held and when.
Then there is what you actually want. Money back, a person removed, a criminal referral, an insurance claim, a quiet resolution, or an organisation this never happens to again. These pull in different directions. A report to the authorities and a commercial recovery can sit together, but they run at different speeds and neither substitutes for the other. Deciding early which outcome matters most shapes every step after it.
What we do
Containing it quietly
Closing off what is still exposed without announcing to anybody that it has been noticed.
Preserving what matters
Records and accounts held as they are, before ordinary business processes destroy them.
Where an employee is involved
Handled so that the employment position and the recovery position do not damage each other.
Notifications and reporting
Working out who has to be told, including insurers and any duties your business carries, and in what order.
What happens next
A route to recovery, to the authorities or to nothing at all, chosen deliberately rather than by default.
When to spend nothing
Not every loss justifies a response. Where the sum is small, the exposure has been closed and there is nothing to recover, an investigation can cost more than the fraud did and occupy the people whose attention the business actually needs. Writing it off is a legitimate decision when it is made deliberately, with the hole that allowed it closed at the same time.
It is also worth being honest about what an investigation is for. If the purpose is to know who did it, and everybody already knows, the money is better spent on the recovery or on the controls. The version of this that wastes the most money is the one run to satisfy a feeling rather than to reach a decision.
Finance and crypto
More on finance and crypto
- Asset tracing
- Crypto recovery
- Structuring digital assets
- Counterparty intelligence
- Recovery and enforcement
Before anything is sent
Positions harden the moment the other side takes advice, and the quiet routes stop being available once a demand has gone out. While nothing has been sent, everything is still open.