Fraud Investigations: Identifying and Preventing Scams

A fraud investigation should establish the deception, the money or benefit involved, the people and accounts connected to it, the evidence available and the quickest realistic route to limit further loss. In many cases the first priority is not identifying the fraudster; it is contacting the bank or payment provider, preserving communications and preventing additional payments while the evidence is still available.

At Trojan Investigations, we investigate fraud from the evidence outward. We do not assume that an online profile, bank-account name, phone number or IP address proves who committed the fraud. Each identifier has to be corroborated and handled within the legal powers available to a private investigator.

Published: 12th February 2024   |   Updated: 4th September 2026

Fraud Is Not One Type of Crime

Fraud covers many different schemes. Some depend on stolen credentials; others persuade the victim to authorise the payment. Some involve an employee, director or supplier; others use fake investments, romance, impersonation, online marketplaces or identity misuse.

The investigative method should therefore match the fraud. A card transaction, fake invoice, investment platform and false employee expense claim produce very different evidence.

The Scale of Fraud in 2026

Office for National Statistics figures for the year ending March 2026 estimated 4.5 million fraud incidents in England and Wales and 3.8 million victims. Within that total, bank and credit account fraud rose to around 2.8 million incidents.

UK Finance's Annual Fraud Report 2026 reported £1.28 billion in payment-fraud losses during 2025. Unauthorised fraud losses were £703.4 million across 3.81 million reported cases, while Authorised Push Payment fraud losses reached £576.4 million across 248,070 cases.

These datasets measure different things, so they should not be combined as if they represent one unified count. What they do show consistently is that fraud is a high-volume problem affecting both individuals and businesses.

Report Fraud Replaced Action Fraud in 2026

In January 2026, the City of London Police launched Report Fraud as the new national service for reporting fraud and cybercrime in England, Wales and Northern Ireland. It replaced the previous Action Fraud service.

A private investigation does not replace a police report. Where criminal conduct is suspected, especially where there is ongoing risk or substantial loss, the client should consider the appropriate reporting route alongside any private evidential work.

Authorised Push Payment Fraud

APP fraud happens when the victim is manipulated into authorising the transfer themselves. The criminal may impersonate a bank, police officer, supplier, solicitor, investment firm, family member or romantic partner. Because the payment is authorised, the evidence often centres on deception rather than unauthorised account access.

The Payment Systems Regulator's mandatory reimbursement protections have applied to qualifying APP scam payments since 7 October 2024. The standard maximum reimbursement level is £85,000 for in-scope claims, subject to the rules and exceptions. The PSR's July 2026 dashboard said that across the first 18 months of the policy, 88% of money lost on reimbursable claims had been reimbursed.

Business Email Compromise and Invoice Fraud

Invoice fraud can begin with a genuine email account being compromised or with a convincing lookalike address. The criminal waits for an expected payment and changes the bank details at the right moment.

Investigation should examine the email route, account logins, rules, invoice history, telephone verification process and payment approval. It is often a mistake to focus only on the receiving bank account and ignore how the criminal gained enough knowledge to make the instruction believable.

Investment Fraud

Investment scams may use professional websites, fake testimonials, cloned regulated firms, social-media advertising and prolonged relationship-building. UK Finance reported £221.5 million in APP investment-fraud losses in 2025, the highest loss category within its APP fraud breakdown.

The FCA maintains information about authorised firms and scam reporting. Investors should verify regulatory status through official FCA channels rather than a link supplied by the person promoting the investment.

Romance and Relationship Fraud

Romance scams exploit trust over time. The claimed identity may be supported by stolen photographs, fabricated employment, fake travel emergencies or supposed investment opportunities. The emotional component makes these investigations particularly sensitive.

A useful investigation can compare claimed identity, images, public records, online presence, payment destinations and inconsistencies in the timeline. It should not promise that a social-media profile or image search alone will reveal the real person.

Corporate and Employee Fraud

Internal fraud can involve expenses, procurement, false suppliers, payroll, theft, manipulation of records or conflicts of interest. Businesses should preserve financial and access records before confronting a suspected employee where there is a realistic risk evidence could be altered.

Our business investigation services can support lawful enquiries into suspicious commercial relationships, undisclosed interests, employee activity and other corporate concerns. HR, legal and data-protection advice should be involved where monitoring or disciplinary action is contemplated.

Evidence Preservation After Fraud

Private Investigators Cannot Compel Banks or Platforms

A private investigator cannot require a bank, telecoms provider, social-media platform or internet service provider to disclose protected customer records simply because fraud is suspected. Those records may require consent, litigation processes, police powers or another lawful route.

This limitation should shape the investigation. We focus on evidence a private client can lawfully obtain or provide, public and commercial intelligence, witness enquiries and corroboration.

Fraud Attribution Is Harder Than Finding an Identifier

A fraudster may use another person's bank account, a mule account, a stolen phone number, a compromised email address, a fake company or a VPN. Investigators therefore distinguish between an account associated with the fraud and the person who controlled the fraud.

A defensible attribution may require several independent links: identity documents, company connections, phone use, public profiles, payment flow, witness information, device evidence or law-enforcement records.

How a Fraud Investigation Is Structured

Fraud Prevention for Businesses

Prevention is strongest when payment and identity controls make social engineering harder. Useful measures include dual authorisation for material payments, call-back verification using trusted contact details, separation of duties, multi-factor authentication, supplier bank-detail change controls and staff training based on real scenarios.

Technology helps, but people still need permission to slow a transaction down when something feels wrong.

Fraud Prevention for Individuals

• Do not move money to a “safe account” because of an unexpected call.
• Verify investment firms through official FCA records.
• Do not share one-time passcodes with callers or message senders.
• Use a trusted phone number to verify bank-detail changes.
• Be cautious when a new online relationship quickly involves money.
• Do not pay upfront fees to unknown recovery companies promising guaranteed recovery.
• Contact your bank immediately if you think you have paid a scammer.

Can Stolen Money Be Recovered?

Sometimes, but recovery is not guaranteed. Speed, the payment method, the receiving institution, whether funds remain available, reimbursement rules and any civil remedies all affect the outcome.

A private investigator should not take a large upfront fee on the promise that they can “recover” cryptocurrency, force a foreign bank to return funds or guarantee the identity of the fraudster. Be especially cautious of recovery services that contact victims unsolicited.

Fraud Investigations for Litigation

Where a client is considering civil recovery, the evidence should be coordinated with legal advisers. Our legal and litigation investigation support can help with factual enquiries, witness location, company intelligence, open-source evidence and other proportionate investigation within the solicitor's case strategy.

When to Use Trojan Investigations

A private investigation may be useful when the immediate banking and reporting steps are underway but factual gaps remain: the identity behind a business, links between people and companies, whether representations were genuine, a chronology of communications or evidence relevant to litigation.

If you are dealing with online or digital elements, our security services may also form part of the wider response. You can book a confidential consultation with Trojan Investigations to discuss the evidence already available and what can realistically be investigated.

Reporting, Investigation and Recovery Are Three Different Workstreams

Victims often use the word “investigation” to describe everything that happens after a fraud, but three processes may run in parallel. Reporting passes information to police, regulators or the national fraud service. Investigation establishes facts and evidence. Recovery concerns reimbursement, freezing funds, insurance or civil remedies.

A private investigator can support the evidence work, but cannot replace the bank's fraud team, compel a receiving bank to freeze money or promise a police investigation. Clear expectations prevent victims from paying for work that cannot achieve the result they actually need.

Receiving Accounts May Be Mule Accounts

The name attached to a receiving account is not necessarily the organiser of the fraud. Criminal networks can use money mules, compromised accounts or people persuaded to receive and forward funds. An investigation should therefore avoid presenting the beneficiary account holder as the mastermind without further evidence.

Links between multiple payments, companies, phone numbers, domains and public identities can help build a wider intelligence picture, but bank transaction pathways beyond the client's own information may require formal powers or legal process.

Fake Companies and Cloned Firms

A company appearing on Companies House does not prove that the person contacting the victim genuinely represents it. Fraudsters can impersonate real companies, use recently incorporated entities, copy websites or clone the details of regulated firms.

Verification should use independent contact details and official registers rather than links, phone numbers or documents supplied by the person asking for money. For regulated investments or financial services, the FCA's official records and warnings are particularly important.

Why Fraud Victims Are Targeted Again

Once someone has lost money, their details can circulate among criminals. A second person may then claim to be a lawyer, investigator, regulator, cryptocurrency specialist or government agent who can recover the original loss for a fee. The more detailed their knowledge of the first fraud, the more convincing the approach may feel.

A Strong Business Anti-Fraud Control Uses Verification, Not Trust Alone

Fraud prevention should assume that a convincing message can come from a compromised genuine account. That is why independent verification matters. A supplier bank-detail change should be checked through a previously trusted contact route. High-value payments should not depend on one person's approval. Sensitive account access should use strong authentication.

Controls also need to cover absence and urgency. Criminals often exploit end-of-day pressure, annual leave, senior-management travel or a supposed confidential transaction to persuade staff to bypass normal checks.

An Illustrative Supplier-Fraud Investigation

A business receives an apparently genuine email from a supplier advising that its bank details have changed. The invoice is paid, but the real supplier later says it never sent the change. The investigation begins by preserving the email with headers, identifying whether the supplier or customer's mailbox was compromised, documenting the payment approval, checking whether previous genuine messages were visible to the attacker and recording the beneficiary account details.

OSINT may then examine the domain, business names, phone numbers and other identifiers used. The bank and Report Fraud handle the formal payment and crime-reporting routes. If the loss leads to a dispute over responsibility, the evidence package can be provided to the client's solicitor. Each workstream has a different role, and keeping them separate makes the response more effective.