Insights
Written for people in the middle of a matter, not for a security conference. Each briefing explains a pattern, the evidence that documents it, and the practical step that follows.
Featured briefing
Contact details of people who have already lost money circulate between operations. A second approach, often within thirty days, is one of the most reliable patterns in this field, and it is deliberately engineered to feel like relief rather than risk.
The tells are consistent: an unsolicited approach, knowledge of your specific loss, a claim that funds are already held or frozen, an official looking reference, and a payment required before release. Legitimate practices do not work that way, and no authority collects a release fee.
More briefings
Card, faster payment, wire, remittance and stablecoin transfers each carry different procedures, different windows and different evidence. Identifying the rail correctly is usually the single most useful thing a client can do before instructing anyone.
Includes: how to read a payment reference, and what to ask your bank for in writing.
A public ledger proves movement, not identity. Attribution depends on where funds touch a regulated service and whether that service cooperates. This briefing separates what the chain shows from what people assume it shows.
Includes: why a transaction hash is worth more than a wallet screenshot.
Export rather than screenshot. Keep originals untouched. Record dates in one place. Ten minutes of preservation at the start regularly determines what is possible three months later.
Includes: a preservation checklist you can work through in one sitting.
Nearly every business email compromise we read passed through an approval process working exactly as designed. The gap is almost always verification of changed bank details through an independently sourced phone number.
Includes: a three line policy most finance teams can adopt this week.
Your bank, your local police service, the relevant financial regulator and the platform involved all have different intake expectations. Sending the same generic email to all four is the most common wasted step.
Includes: what a usable report contains, and what it should never contain.
Warning signs
None of these is proof on its own. Two or three together justify stopping and verifying independently.
Glossary
Have a question the briefings do not answer?
Send the specifics. If it can be answered in a paragraph, it will be, at no cost and with no follow-up sales contact.
