Methodology
How a matter is worked, from first read to closing note
The same five phases apply to every file, whatever its size. The detail below is the actual working process, not a summary of it.
Operating principles
Four rules the process is built on
A conclusion enters the pack only if a named source supports it. Inference is labelled as inference.
Raw material is never edited. Working copies are separate and versioned.
Every fact is anchored to a date and a source, so the narrative can be checked line by line.
The analyst who builds the pack is not the analyst who signs it off.
We request only what the analysis needs. Anything else is declined.
Each deliverable states what could not be established and why.
The five phases in detail
What actually happens, week by week
Intake and triage
Your submission is read in full by a named analyst, not a form processing script. We check the loss type, the payment rails, the jurisdictions touched, the time elapsed and the material you already hold, then write a plain assessment of whether a documented route exists.
Deliverables
- Written first review of the matter
- Route map of options that remain open
- Named case lead and a direct contact address
Your part
- Send dates, amounts and payment methods
- Add any bank or police reference numbers
- Confirm how and when we may contact you
Milestones
- Reference number issued the moment intake is received
- Written first review returned within two business days
- Free of charge, with no obligation to continue
Evidence assembly
Everything you hold is indexed with a source, a date and a description. Duplicates are collapsed, screenshots are matched to underlying records where possible, and a gap list is produced: the specific items worth requesting from your bank, your platform or your email provider.
Deliverables
- Indexed evidence pack with exhibit numbering
- Gap list naming the records worth requesting
- Factual chronology of the matter
Your part
- Export original emails rather than screenshots
- Request statements your bank still holds
- Flag anything you would rather not disclose
Milestones
- Every exhibit carries a source and a date
- Unverified items are labelled, never assumed
- You approve the chronology before it is used
Tracing and analysis
Payments are followed leg by leg across bank rails, card schemes, remittance corridors and public blockchains. Each hop is recorded with the reference that proves it. Where a hop cannot be evidenced, it is marked unresolved rather than filled in with an assumption.
Deliverables
- Flow of funds analysis with source references
- Counterparty and platform profile notes
- Written view on which routes stay realistic
Your part
- Supply wallet addresses and transaction hashes
- Confirm which accounts the payments left from
- Tell us about any later contact from the parties
Milestones
- Each hop is either evidenced or marked unresolved
- Findings reviewed by a second analyst
- You are told promptly if a route closes
Documentation
The material becomes a referral pack: a factual narrative, an indexed exhibit set, the flow of funds analysis and cover notifications written for each recipient, whether that is a bank fraud team, a payment provider, a regulator, an exchange or your own counsel.
Deliverables
- Referral ready pack in the format each recipient expects
- Draft notifications for banks, platforms and authorities
- Summary sheet your counsel can act on directly
Your part
- Read and approve the narrative for accuracy
- Sign notifications that must come from you
- Keep us copied on replies you receive
Milestones
- Pack states clearly what could not be established
- Nothing is sent in your name without approval
- You keep the pack whether or not you continue
Coordination and closing note
Correspondence is tracked, responses are logged and follow ups are scheduled. When routes are exhausted we say so, and you receive a closing note that records what was done, what was found and what remains available to you.
Deliverables
- Response log covering every institution contacted
- Scheduled written updates while the file is live
- Closing note when the routes are exhausted
Your part
- Forward institutional replies as they arrive
- Decide at each stop point whether to continue
- Tell us if your circumstances change
Milestones
- Written updates at agreed intervals
- Our fee is 5% of any amount recovered for you
- Nothing renews silently and you can stop at any point
Click a phase to see the deliverables, what we need from you and the milestones. Durations are a typical engagement target, an internal working objective rather than a commitment. Actual timeframes depend on the facts, the jurisdictions, the counterparties and the legal or regulatory process involved.
Evidence standards
What makes a document usable
| Material | What we ask for | Why it matters |
|---|---|---|
| Bank records | Full statements covering the period, plus payment confirmations with references | Reference numbers are how a receiving institution locates the credit |
| Original messages with full headers, exported rather than forwarded | Headers carry routing data that a screenshot destroys | |
| Messaging apps | Native chat exports including timestamps | Ordering and timing frequently establish inducement |
| Platform activity | Account statements, trade histories, withdrawal requests and rejections | Shows the mechanics of how withdrawal was blocked |
| Crypto | Transaction hashes and the addresses you sent from | Hashes are verifiable independently; screenshots are not |
| Correspondence with the counterparty | Everything, including what feels embarrassing | Pressure language is often the strongest part of the record |
Where the effort goes
Most of the work is reconstruction, not discovery
Clients often expect the analysis to be dominated by tracing. In practice, the majority of hours on a typical file are spent turning scattered material into a coherent, checkable record, the part that determines whether an institution can act at all.
Indicative distribution across recent documentation engagements; individual matters vary widely.
Limits of the method
What analysis cannot do
It cannot compel anyone
We can document and notify. Only courts and authorities can compel disclosure, freeze accounts or order repayment.
It cannot recreate deleted data
Where platform logs, exchange records or messages have already gone, no method restores them.
It cannot outrun jurisdiction
Some counterparties sit where no practical enforcement route exists, and we will say so plainly.
See it applied
Read how the method looks on real shaped matters
The case studies show the same five phases applied to different loss types, including the ones that ended without a recovery.
