Fraud Investigation
Predication and planning
An investigation begins with predication - a reasonable, fact-based basis to believe fraud has occurred or is occurring. A hunch is not predication. The investigator then documents a plan: scope, objectives, evidence required, resources, timeline, and a confidentiality strategy.
Evidence discipline
Evidence types are testimonial, documentary, physical, personal observation, and demonstrative. Original documents and third-party records outrank a single witness's recollection. Maintain an unbroken chain of custody - a gap invites a challenge to authenticity and can cost you the evidence. For digital evidence, image the device, record a hash value, and analyze the copy, never the original.
Interviews
Sequence matters. Interview neutral third parties and corroborating witnesses first and the subject last. A sound structure moves from informational (background, no accusation) to fact-finding (probing the specific transaction and testing explanations) to admission-seeking (only when evidence is already sufficient). Ask open questions early, funnel to closed questions to lock down details, and never treat body language as a lie detector - research supports no universal deception cue.
Analytics
Duplicate-payment tests, gap analysis, Benford's Law on naturally occurring numbers, and relative-size factor generate leads, not conclusions. Every analytic hit needs documentary corroboration before it is put to a subject.
Traps
Accusing too early, implying leniency or making threats, letting an interview become a de facto detention, and failing to log custody transfers. Another trap: treating an admission as the end of the case when it still needs corroboration.
Rule of thumb
Evidence before confrontation. The admission-seeking interview is the final step of an investigation, never the opening move.