Suspected fraud often begins with something disappointingly small: a changed bank account, an invoice that does not reconcile, a director whose explanation shifts, or a debtor apparently continuing the same trade through a different company. None of those facts proves dishonesty. Each can, however, change what must happen next.
The quality of the early response matters because delay changes the evidence. Mailboxes are altered, websites disappear, employees leave, assets move and recollections harden into narratives. The correct first task is not to write the allegation. It is to preserve the ability to find out what happened.
Why detection speed changes the loss
ACFE's Occupational Fraud 2026 study examined 2,402 cases across 143 countries and territories. The cases caused more than $3.4 billion in aggregate losses. The median scheme lasted 12 months before detection; cases detected within six months produced a median loss of $40,000, compared with more than $1.1 million where schemes continued for over five years. 1
Those figures concern occupational fraud, not every form of commercial deception, and they should not be mechanically applied to an individual matter. Their practical value is the relationship they show: duration is not administrative delay. It is a risk variable.
The same study found that tips were the most common detection method, accounting for 43 per cent of cases, while more than half of cases involved missing controls or control override. 1 A report that arrives through a colleague, supplier or whistleblower may therefore be important, but the allegation and the evidence supporting it must remain separate.
The first-response sequence
The sequence is deliberately conservative. It protects evidence and options without assuming that the initial concern is correct.
Define the issue
Write one neutral sentence describing the decision or suspected event. Identify what would confirm, contradict or materially qualify it.
Preserve
Secure original emails, headers, messaging exports, contracts, invoices, payment instructions, access logs and changing online material.
Control knowledge
Decide who needs to know. Avoid unnecessary circulation, premature accusation and contact that may alert a subject or contaminate evidence.
Map the system
List people, entities, accounts, addresses, domains, devices, advisers and transactions before performing deep searches.
Test independently
Use sources and contact routes that do not depend on the questioned material. Reconcile chronology, authority and payment flows.
Escalate lawfully
Coordinate legal, banking, insolvency, regulatory, technical and law-enforcement decisions with the appropriate specialists.
An evidence ladder prevents language from outrunning proof
Established fact
A record or event supported by a sufficiently reliable source and accurately described within its limits.
Corroborated indicator
Separate sources support the same relevant proposition, but do not prove motive, control or dishonesty.
Analytical inference
A reasoned interpretation drawn from facts, with the reasoning and credible alternatives stated.
Allegation
A claim made by a person or source. Repetition does not transform it into a finding.
Unknown
A material question for which the available sources do not support a reliable answer.
The debtor who did not disappear
A supplier enters liquidation owing a substantial trade debt. Within weeks, a business with a similar name begins serving the same market from the same industrial estate. Several employees appear on its website and a familiar telephone number is used. The initial temptation is to call it a fraudulent phoenix.
A disciplined review would first establish legal identities, asset ownership, dates, consideration for any transfer, customer and employee continuity, control, insolvency-officeholder information and the source of each allegation. The same visible pattern could reflect misconduct, a legitimate sale, a secured creditor's enforcement, an employee-led restart or a mixture of lawful and questionable events.
The Insolvency Service reported 148 completed civil investigations involving abusive phoenixism in 2025-26. Outcomes included 18 companies shut down in the public interest, 87 director disqualifications and five criminal convictions. 3 Those figures demonstrate active enforcement; they do not remove the need to prove the facts in each case.
What different professionals need from the same facts
| User | Immediate question | Useful output |
|---|---|---|
| Solicitor | Which facts affect remedy, pleading, disclosure, preservation or pre-action strategy? | Chronology, source schedule, party map and clearly graded findings. |
| Insolvency practitioner | What happened to value, records, customers and control before and after distress? | Connected-party map, transfer timeline and targeted lines of enquiry. |
| Creditor | Does further expenditure have a realistic route to recovery? | Proportionate asset indicators, priority risks and cost-sensitive next steps. |
| Board or audit committee | Is the concern contained, systemic or continuing? | Control-failure analysis, affected population and preservation plan. |
| Bank or technical responder | Can funds, access or evidence still be secured? | Verified transaction data, authenticated communications and escalation contacts. |
Red flags are prompts, not verdicts
The Office for National Statistics estimated 4.4 million fraud incidents in England and Wales in the year ending December 2025. 2 The Government's 2026-29 Fraud Strategy also identifies courier fraud, investment fraud, payment diversion and romance fraud among the highest-harm types reported by the NCA in 2025. 4 The scale makes preparation necessary, but prevalence does not lower the evidential threshold for accusing a person or company.
A late change of bank details may indicate payment diversion, an internal process error or a legitimate change poorly communicated. Repeated short-lived companies may show abusive phoenixism, volatile trading conditions or unrelated ventures. Apparent lifestyle inconsistency may be relevant to recovery but can be distorted by borrowing, family wealth, leasing or misidentification.
A useful investigation does not make warning signs sound more dramatic. It asks which explanation best fits the verified chronology, what evidence could distinguish alternatives and whether the likely answer would change the available decision or remedy.
The decision to stop is also an investigative result
Not every inconsistency justifies a full investigation. A focused first stage may show that the issue has an ordinary explanation, that the evidence cannot be developed proportionately, or that even a favourable finding would not improve recovery. That is useful decision support, not failure.
Equally, a modest first stage can expose urgency: assets at risk of dissipation, systems still compromised, a continuing payment channel or evidence likely to disappear. The investigation plan should then be built with the lawyers, officeholders, technical specialists or authorities responsible for the next action.
The purpose of triage is to keep fact-finding aligned with remedy. It replaces the question 'does this look suspicious?' with a better one: 'what can be established in time to change what we do?'
What to carry into the next decision
- Preserve first; interpret second.
- Record facts, indicators, inferences, allegations and unknowns as different categories.
- Build the party and transaction map before searching deeply.
- Let remedy, urgency and recoverability determine the next stage of work.
Sources and reading
Sources were accessed and checked for this edition on 17 July 2026. Reported allegations and ongoing proceedings are identified as such in the text.
- 1
Association of Certified Fraud Examiners. Key findings from Occupational Fraud 2026: A Report to the Nations. May 2026.
- 2
Office for National Statistics. Crime in England and Wales: year ending December 2025. 23 April 2026.
- 3
The Insolvency Service. Annual Report and Accounts 2025-2026. 14 July 2026.
- 4
HM Government. Fraud Strategy 2026 to 2029. 30 April 2026.
Scope note
This article provides general information and analysis. It is not legal, insolvency, financial, regulatory, cybersecurity or other professional advice. Public records and reported material can be incomplete, delayed or disputed; an indicator is not proof of misconduct.
About the author
Verify Carratu International Ltd
VCI provides investigation, intelligence and due diligence support to organisations, professional advisers and private clients. Work is scoped around the decision, the evidence available and the need for proportionate, clearly qualified reporting.
Discuss a related matter