Fraud Rarely Arrives as a Complete Case

Why detection speed changes the loss

ACFE's Occupational Fraud 2026 study examined 2,402 cases across 143 countries and territories. The cases caused more than $3.4 billion in aggregate losses. The median scheme lasted 12 months before detection; cases detected within six months produced a median loss of $40,000, compared with more than $1.1 million where schemes continued for over five years. ¹

Those figures concern occupational fraud, not every form of commercial deception, and they should not be mechanically applied to an individual matter. Their practical value is the relationship they show: duration is not administrative delay. It is a risk variable.

The same study found that tips were the most common detection method, accounting for 43 per cent of cases, while more than half of cases involved missing controls or control override. ¹ A report that arrives through a colleague, supplier or whistleblower may therefore be important, but the allegation and the evidence supporting it must remain separate.

Red flags are prompts, not verdicts

The Office for National Statistics estimated 4.4 million fraud incidents in England and Wales in the year ending December 2025. ² The Government's 2026-29 Fraud Strategy also identifies courier fraud, investment fraud, payment diversion and romance fraud among the highest-harm types reported by the NCA in 2025. ⁴ The scale makes preparation necessary, but prevalence does not lower the evidential threshold for accusing a person or company.

A late change of bank details may indicate payment diversion, an internal process error or a legitimate change poorly communicated. Repeated short-lived companies may show abusive phoenixism, volatile trading conditions or unrelated ventures. Apparent lifestyle inconsistency may be relevant to recovery but can be distorted by borrowing, family wealth, leasing or misidentification.

A useful investigation does not make warning signs sound more dramatic. It asks which explanation best fits the verified chronology, what evidence could distinguish alternatives and whether the likely answer would change the available decision or remedy.

The decision to stop is also an investigative result

An initial assessment tests the available explanations, evaluates the evidence that can be developed proportionately and considers how the findings could affect recovery. This gives the client a clear basis for agreeing the next action, including closing a resolved concern.

An initial assessment can also identify urgent priorities: assets at risk of dissipation, systems still compromised, a continuing payment channel or evidence likely to disappear. The investigation plan should then be built with the lawyers, officeholders, technical specialists or authorities responsible for the next action.

The purpose of triage is to keep fact-finding aligned with remedy. It replaces the question 'does this look suspicious?' with a better one: 'what can be established in time to change what we do?'

The record can be part of the fraud

Fraud analysis becomes more difficult when apparently independent records repeat the same false premise. Corporate filings, websites, professional biographies, invoices and correspondence may look like separate corroborating sources even when they derive from a single invented narrative. Register reform is reducing that risk, but Companies House itself describes the continuing task as one of removing misleading information and disrupting abuse of the register. ⁵

For insolvency and litigation professionals, this is why chronology often matters more than the number of records located. A directorship created shortly before a transaction, a sudden change of registered office, a dormant company becoming active, or a cluster of connected filings can be entirely innocent. Their significance lies in how they relate to the disputed event, the flow of value and the explanations given by the parties.

The evidential discipline is equally important. A filing is evidence that a filing was made; an allegation is evidence that an allegation exists. Neither should silently become proof of the underlying conduct. Keeping fact, inference and allegation separate is not caution for its own sake: it protects the usefulness of the analysis when it reaches solicitors, insolvency practitioners, insurers or a court.

Insolvency changes the meaning of the same facts

A transaction that appears ordinary in a healthy trading company can acquire a different significance when viewed against deteriorating liquidity, creditor pressure or the prospect of formal insolvency. Payments to connected parties, changes in security, asset disposals and alterations in trading arrangements are not inherently improper. Their relevance depends on timing, value, purpose and the legal duties engaged at the time.

That makes hindsight particularly dangerous. Once a company has failed, every unusual payment can look like an obvious warning sign. A useful analysis instead asks what was known or reasonably inferable at the relevant date and distinguishes commercial stress from evidence of dishonesty. Insolvency practitioners and litigators need a chronology capable of supporting that distinction, not a retrospective narrative built around the eventual collapse.