Case studies

Composite matters, described honestly, including the ones that closed with nothing

The matters below are illustrative composites built from the shapes of real files, with identifying details removed. They are published to show method and limits, not to imply results.

Illustrative compositesNo results impliedMethod focused

Read this first. Nothing on this page is a prediction. Outcomes and timeframes depend entirely on the underlying facts, the quality of evidence, the jurisdictions involved, the conduct and solvency of counterparties, and applicable legal and regulatory processes. Many matters conclude with no financial recovery.

Selected matters

Four shapes of file

Romance led investment · three jurisdictions · 11 months elapsed

A relationship that became a trading account

Situation. Contact began on a dating platform and moved to a messaging app within a week. Over nine months the client made eleven payments to what appeared to be a regulated broker, two by card and nine by bank transfer, before withdrawal requests triggered a “tax clearance” demand.

What we did. Reconstructed the full payment timeline from statements, exported the message history with timestamps to establish the inducement sequence, identified the receiving accounts and the corridor used for the later transfers, and prepared notifications for two banks and the platform’s nominal regulator.

Where it landed. One card leg met the criteria for a scheme dispute. The transfer legs were notified and logged; two receiving accounts had already been closed. The client received a documented file and a closing note setting out the routes that remained and those that did not.

Business email compromise · single jurisdiction · 6 days elapsed

An invoice that changed its bank details

Situation. A supplier’s mailbox was compromised and a genuine invoice was reissued with new account details. The payment was made within the normal approval process; nobody did anything unusual.

What we did. Preserved original headers from both mailboxes, established the point of interception, produced a factual narrative for the paying bank within 48 hours of instruction, and drafted the parallel notification to the receiving institution.

Where it landed. Because the matter arrived quickly, notification reached the receiving bank while part of the credit remained unallocated. The client also received a control review covering supplier detail verification and dual approval.

A cryptocurrency coin resting on circuitry

Crypto withdrawal block · multi-hop · 4 months elapsed

Balances that could not be withdrawn

Situation. A trading dashboard displayed steady gains. Every withdrawal attempt produced a new prerequisite: verification fee, liquidity fee, then a personal “manager” requesting a final payment.

What we did. Traced the on chain path from the client’s own wallet through intermediate addresses to two exchange deposit clusters, documented each hop by hash, and submitted attribution requests through each exchange’s law enforcement and compliance intake.

Where it landed. One cluster was attributed to a registered exchange, which acknowledged the report and asked for a law enforcement reference; the client obtained one with our documentation. The second cluster resolved to a service outside any cooperative jurisdiction, and we told the client plainly that this leg was not pursuable.

Recovery room approach · no fee charged · closed at first review

The second approach after the first loss

Situation. Eight weeks after an initial loss, the client was contacted by a firm claiming to hold seized funds and requesting an administration payment to release them.

What we did. Read the correspondence, identified the pattern, and confirmed in writing during the free first review that the approach carried the standard characteristics of a re-victimisation attempt.

Where it landed. No engagement was opened and no fee was charged. The client was given a written note to accompany their existing report to the authorities, and guidance on cutting contact safely.

What actually moves a matter

The variables that changed the picture most

Factor	Effect observed	What you can control
Elapsed time	Notifications sent within days behave very differently from those sent months later	Report and instruct as early as possible
Original records	Native exports and full headers open routes that screenshots do not	Preserve originals; stop forwarding and re-screenshotting
Payment rail	Card, bank transfer and crypto legs each have separate procedures and windows	Record exactly how each payment was made
Counterparty jurisdiction	Cooperation varies enormously by where the receiving service is based	Nothing, but it should shape expectations
Existing reports	A police or regulator reference materially helps institutional intake	Report to your bank and local authority regardless of value

Client perspective

What people say afterwards

“Two of the four routes were closed before we started, and they told me that in the first week rather than billing me to find out slowly.”

Composite client feedback

1 in 3First reviews closed with no engagement

48hTarget for the first written read

5000+Recovery promises made and kept

100%Matters given a written closing note

Your matter is not a template

Send it in and get a specific answer

The only way to know which of these shapes your matter resembles, if any, is to have an analyst read it.

Start secure intake Talk to the case desk

A case-desk analyst taking notes during a client call