Fraud Investigation & Recovery

Advising on Strategy

Within the first 48 hours of discovering suspicions of fraud or corruption, critical mistakes are made that are never recovered. The most common failures are that the organisation:
  • Panicked and assumed the suspicions had to be resolved immediately;
  • Turned to unqualified advisers;
  • Did not take suspicions seriously;
  • Under-estimated the determination of their opponents;
  • Took disciplinary or other action before the facts had been established and, as a result, was put on the defensive;
  • Alerted the suspects, allowing them to destroy evidence, silence witnesses, prepare excuses and to counter-attack;
  • Conducted an inefficient or illegal investigation, resulting in the exclusion of evidence at trial;
Cobasco examines Clients’ contingency plans and resources for conducting investigations. The output is usually incorporated in check lists and training for senior managers, audit and security specialists.

You would like a copy of our 50 page publication on conducting investigations and interviews please email us at

Conducting Investigations

Setting Objectives

We work with Clients to define the objectives of the investigation: the priority being to establish the complete facts of the worst case, as quickly and as quietly as possible, within the law, using the most effective, legally permissible, ethical and proportionate tools and techniques that:

  • Produces overwhelming evidence that:
    • totally clears innocent people wrongly suspected (including the company itself);
    • gives skulduggers no room to manoeuvre, leading to their full cooperation and financial and other recovery,;
    • avoids contested proceedings in court and minimises legal and other costs;
  • Prevents repetition;
  • Creates a deterrent to others; this usually means criminally prosecuting, taking disciplinary and recovery action;
  • Minimises disruption to the business and protect the company’s reputation;
  • Improves controls;
  • Uncovers other cases;
  • Defends or mitigates regulatory action.
Remedies may include civil and criminal prosecution, search and seizure orders, dismissal, termination of contracts or other sanctions. In most cases, recovery of losses and ALL COSTS is a key objective. In other cases defending regulatory action is the priority.

Case Analysis and Fraud Theory

This is the starting point in most cases and we apply our experience to develop a “fraud theory” setting out the precise pathology of the dishonesty suspected.  Often the first suspicions are incomplete, the actual losses much greater than they seem and the collusion more extensive. But there are always exceptions and it is therefore critical to keep the theory updated as new facts emerge.

The Investigations Plan
In most investigations the first step (which is the first time those involved become aware that they are under suspicion) should be planned with extreme care. It is usually critical.
Based on clear objectives and a fraud theory, we specify an investigation plan and budget, setting out the precise steps, tools, techniques, reporting methods and frequencies, internal and external resources necessary to complete the investigation quickly and effectively. In larger or more sensitive cases, the plan is submitted for approval by the directors and their legal advisers and then entered into a case management data base to control all completed and pending actions, exhibits and disclosures.

Internal Security and Counter-surveillance

Even the most effective investigation can be compromised by inadequate internal security. Countermeasures ensure that investigations are fully protected.

Intelligence Gathering

The investigation plan identifies the best case admissible evidence. However, there is usually an intermediate step when intelligence is uncovered which is not in an admissible form. Depending on the case and specific legal advice, intelligence gathering techniques are likely to include:
  • Database research of all publicly available sources;
  • Visual surveillance, including GPS trackers, micro cameras, microwave transmitters, fixed and mobile observation;
  • Audio surveillance, including telephone interception (only on the Clients’ equipment and in compliance with all applicable laws) and hard wired microphones;
  • Technical surveillance of computers and other electronic equipment, again only under specific legal advice and in compliance with all relevant laws;
  • Computer forensics, including covert and overt imaging of our Clients’ networks and hosts, network and keystroke interception and covert logging;
  • Anticipatory e-discovery;
  • Forensic accounting, including analysis of massive data sets by proprietary automated fraud detection programs;
  • Infiltration and undercover investigations, ranging from test purchases through to elaborate ‘sting’ operations and longer term infiltration of criminal groups;
  • Interviewing, including expert interviewing of informants, potential witnesses and suspects, again under specific legal guidance and in compliance with appropriate laws and evidential rules;
  • Analysis of written statements, other documents and computer files, using advanced analysis techniques.
Often intelligence is sufficient for our Clients’ legal advisers to obtain search, seizure and other Orders through which admissible evidence is obtained and assets frozen.

Evidence Collation and Presentation

Intelligence is analysed so that admissible evidence is obtained, typically including:
  • Criminal Justice Act and other statements;
  • Documentary evidence, chronologies and supporting schedules;
  • Draft Proofs of Evidence and affidavits;
  • Electronic evidence, including recovery of deleted and encrypted files;
  • Exhibit and disclosure schedules’
  • Expert witnesses evidence;
  • Forensic evidence, including DNA, fingerprints, handwriting analysis etc
  • Interview transcripts;
  • Real evidence, photographs, video films and audio tapes;
  • Results of electronic discovery;
  • Schedules of loss and gain calculations;
  • Statements under caution;
Cobasco maintains systems to protect intelligence and evidence and to ensure disclosure requirements are met.


Normally, Cobasco’s reports are protected by legal professional privilege and typically include
  • Presentations;
  • Oral reports;
  • Written reports;
  • Schedules, flow and other charts (including losses and in bribery cases “but for gains”: see the restricted modules for more details);
  • Summaries of recommendations for control improvements.
In bribery investigations – and before any self- disclosure is made - Cobasco ensures that all potential downsides are checked, including simulations of electronic and other “big data” discovery, and interviews with past and present “directing minds”. This precautionary checking is discussed in the restricted modules and it essential before any self-disclosure is made.

Self disclosure does not mean playing blind poker…

Asset Tracing and Recovery

Criminals usually go to great lengths to hide their assets and very little useful information is available in public records. Cobasco has researched hundreds of Offshore Financial Centres, International Business Corporations and Trusts which are most often used to conceal the proceeds of crime. We have the clearest understanding of how such barriers can be penetrated, both by investigative techniques and through the civil and criminal laws.

We have also been successful in penetrating the veils of criminal secrecy using undercover, pretext and sting operations: again always within the law.  If we do not believe we can succeed, we will say so.
We are also expert in securing recoveries through Fidelity Policies, Bankers Blanket Bonds and Electronic Crime Insurance. Normally the optimum recovery strategy will be determined at the start of a case.
© Copyright 2019 Cobasco Group LtdWeb Design By Toolkit Websites