Cybercrime investigations grounded in documented evidence.

What problem does this solve?

A cybercrime can leave fragmented messages, transactions, account records and conflicting explanations. An investigation organizes those observations into a defensible account of what is known, what can be corroborated and what remains uncertain.

Who is it for?

Businesses, authorized representatives, counsel and individuals affected by online crime. Matter types include business email compromise and payment fraud; online scams; impersonation and harassment campaigns; extortion and sextortion; authorized workplace inquiries into suspected insider theft; and account takeover.

What do we do?

We first check conflicts, authority, jurisdiction and lawful basis. Written instruction defines the question, sources, cost and intended recipients. An agreed preservation plan precedes collection. Analysis tests competing explanations, corroborates observations and documents limitations. Findings undergo a second-person review where available; any absence of independent review is disclosed.

Lawful workplace work requires employer authority and an appropriate privacy and employment-law review. We do not conduct covert personal surveillance or access an employee's personal accounts.

What will you receive?

An evidence register, incident timeline, source references, documented handling record and factual findings with confidence levels. Reporting assistance can help you organize material for police, insurers or regulators; the relevant authority determines what it accepts and how it proceeds.

What does a typical engagement look like?

In a fictional invoice-diversion matter, a client has a suspicious message and a changed payment instruction. The investigation compares authorized records, preserves the supplied originals through the agreed evidence channel and records alternative explanations. A domain association alone does not establish who controlled an account or received the money.

What is outside the scope?

Excludes: guaranteed offender identification, recovery of funds, hacking back, pretexting, unlawful surveillance, public attribution, threat-actor engagement and legal representation. Device acquisition or forensic examination requires a separately approved scope, qualified examiner, lawful authority and validated tooling; it is not automatically included.

Extortion work starts with safeguarding and police reporting. We do not negotiate with or pay offenders, collect intimate imagery, or sell a promise that material will disappear. A limited fixed scope is agreed without pressure or financing offers.

How do we begin?

Use confidential matter intake with a short summary and names needed for a conflict check. Do not attach evidence. The draft initial investigation phase starts at $2,500; subsequent work is separately agreed. A submitted inquiry does not create an engagement or legal privilege.

Before you share evidence

A clear description, public account references and confirmation that you own the assets or are authorized to act. We agree an evidence checklist after assessment. Never send passwords or verification codes.