
Fraud Investigations
We investigate physical and cyber fraud, gathering evidence to clarify the facts and inform decisions.
16 solutions to investigate physical and cyber fraud, trace assets and support asset recovery.
16 solutions found
Select a solution to explore the details
We investigate physical and cyber fraud, gathering evidence to clarify the facts and inform decisions.

We trace assets, funds and connections to support the assessment of recovery options.

Examine the history, connections and risks of people or organisations before consequential decisions.

Clarify concerns and discrepancies in third-party relationships.

Organise facts and formal requests for technical engagement with authorities.

Validate vulnerabilities and defences through controlled, authorised attacks.

Investigate suspected misconduct and organise the facts for an impartial response.

Assess digital exposure and threat indicators relevant to the organisation.

Anonymous reports, follow-up and a plan for handling each case.

Assess processes and controls for integrity weaknesses.

Identify and document brand misuse across channels relevant to your business.

Organise the facts and priorities for responding to an incident.

Reconstruct what happened using digital evidence.

Improve threat detection and review access to your systems.

Assess the exposure of sensitive information and strategic environments.

Monitor online threats with human analysis and clear alerts.
Illustrative images of the work involved in each service.
IN YOUR OPERATION
Explore fraud scenarios in operations and digital channels, the solutions that may help investigate them and the deliverables that support each decision.
19 industries and contexts
Procurement and suppliers
Explore this applicationA favoured supplier, an invoice without delivery or changed bank details may require more than a document check. Baruch investigates suppliers, approvals and payments, connecting documents, relationships and digital records to establish the facts and inform action on contracts and controls.
A supplier repeatedly wins orders, submits bids resembling competitors’ proposals and may be connected to an approver. The company needs to verify the relationship, compare prices and substantiate deliveries to distinguish a justified commercial choice from favouritism or an improper benefit.
An investigation report with evidence, a relationship map and points still unconfirmed.
An action plan to check approvals, improve controls and reassess the supplier relationship.
Assess whether the engagement can proceed, needs further checks or requires a different approval level.
A supplier's bank details change shortly before a batch of payments. The company needs to reconstruct who requested and approved the change, check whether accounts were compromised and trace the transferred funds.
A timeline of account changes, approvals, payments and destination accounts.
A report on access and communications reviewed, with indicators of compromise and gaps to investigate.
Decide which findings need further investigation and which payment-change controls need review.
Tell us what happened and which decision you need to make.
Talk to our specialistsTelecom
Explore this applicationThe theft of batteries, cables and other network assets can cause direct losses and service disruption. Baruch connects inventory, site access, maintenance, contractors and possible destinations for the material to establish what happened and support the operator's response.
Batteries disappear from multiple sites and the operator records outages. Inventory, site access, maintenance orders and possible resale channels need to be compared to understand the pattern and assess losses.
A map of missing assets, incidents by site and access records reviewed.
A report on work orders, interviews and possible conduct or control failures, including the investigation's limitations.
Prioritise site protection, assess responsibility and inform measures to recover equipment.
Cables and equipment identified as belonging to the operator appear in a parallel network. The company needs to verify the assets' origin, the maintenance chain and the people behind that network before deciding on action.
A report linking the assets found, ownership records and people identified.
A map of possible equipment destinations and information to assess recovery measures.
Decide which recovery, reporting and control measures are appropriate.
Tell us what happened and which decision you need to make.
Talk to our specialistsFinancial institutions and fintechs
Explore this applicationInconsistent documents, unsupported receivables and unrecognised transfers call for investigation beyond customer verification. Baruch supports financial institutions, fintechs and Brazilian receivables funds in examining counterparties, transactions and digital access, gathering evidence to inform credit decisions, fraud response and steps towards recovering diverted funds.
A portfolio contains duplicate receivables or claims without verified delivery, while the seller, debtors and intermediaries may have undisclosed connections. The institution or receivables fund needs to examine documents, verify relationships and reconstruct transactions before increasing exposure or deciding on further action.
A map of identified connections between the seller, debtors, intermediaries and beneficiaries, with supporting documents.
A report reconciling receivables, contracts, deliveries and payments, including evidence and outstanding checks.
Decide whether the relationship requires corrective action, renegotiation, termination or further investigation, with the responsible teams' support.
An account used by the company records unrecognised logins and transfers. The team needs to establish how the transactions occurred, which funds left the account and what information may help trace them.
A report of the logins and transactions examined, with a timeline and preserved digital evidence.
A map of identified transfers and connections to support assessment of recovery measures.
Set investigation priorities and inform recovery measures with the responsible teams and legal advisers.
Tell us what happened and which decision you need to make.
Talk to our specialistsRetail, e-commerce and brands
Explore this applicationRefunds without returns, improper discounts and goods of uncertain origin affect shops, inventory and digital channels. Baruch connects sales records, access logs, stock movements and commercial relationships to establish how an incident happened, gather evidence and support action involving people, suppliers and processes.
Branded products appear in shops and marketplaces with inconsistent packaging, batch details or origin. The issue may involve counterfeiting, diverted goods or legitimate resale. The company needs to document listings, examine distribution records and check connections between sellers and suppliers.
Records of products, sellers and listings in the agreed physical and digital channels.
A report of connections and discrepancies, separating indicators from confirmed facts.
Prioritise checks and inform the assessment of commercial, legal or platform-related measures.
After unrecognised logins, a customer account requests refunds and changes payment details. The goods are not returned to inventory. The company needs to connect access logs, orders, payments and returns to investigate the concern.
A timeline of logins, account changes, orders and refunds, compared with inventory records.
A report of digital evidence and discrepancies, identifying points for further investigation and control review.
Decide which incidents need deeper review and which checking or approval steps need revision.
Tell us what happened and which decision you need to make.
Talk to our specialistsManufacturing
Explore this applicationInventory discrepancies, scrap write-offs and supplier payments may reflect operational issues or concealed diversion. Baruch investigates documents, movements and conduct in production and procurement, connecting physical and digital evidence to explain losses and inform action on the people, commercial relationships and processes involved.
A plant records higher-than-expected raw material losses and scrap write-offs, but physical counts do not match the system. Goods have been released without checks and records changed. Movements and accounts from those involved need examination to distinguish operational failures from possible diversion.
A map of differences across counts, incoming and outgoing documents and digital records reviewed.
A report of releases examined, interview accounts and compliance with procedures, separating facts from hypotheses.
Support the assessment of the conduct involved and review release and verification procedures.
Maintenance services are repeatedly billed without complete work orders, and purchased parts do not appear in plant records. The contractor may be connected to an approver. The company needs to investigate delivery, the commercial relationship and the sequence of approvals and payments.
A report on the contractor and its connections, linked to the contracts, services and delivery documents examined.
An action plan to improve service verification, separation of approval duties and payment controls.
Assess whether to continue the supplier relationship and decide on approval changes, further checks and action on disputed charges.
Tell us what happened and which decision you need to make.
Talk to our specialistsIntegrity and whistleblowing
Explore this applicationA report needs a clear path to become a useful investigation. Baruch provides a platform for anonymous reporting and follow-up, structures the information and sets out an assessment roadmap. Where required, it investigates conduct through interviews, documents and digital records to support HR, Compliance and Legal.
Reports of favouritism, suspicious payments or misconduct arrive through email, managers and messages without coordinated follow-up. The team cannot identify recurring facts or who is assessing each report. The company needs anonymous intake, structured information and clear responsibilities and next steps.
An anonymous reporting and follow-up platform, with workflow and access agreed with the company.
Structured reports and a roadmap of priorities, open questions and recommended referrals.
Decide who assesses each report, what information is missing and how to follow up on next steps.
A report describes repeated humiliation by a manager, refers to messages and witnesses and raises concern about retaliation. HR and Compliance need to structure the information, arrange an impartial investigation and examine the evidence and accounts of those involved before deciding on appropriate action.
A structured report and roadmap of priorities, available information and questions to clarify.
A report of the commissioned investigation, including interviews, records examined, verified facts and reasoned conclusions.
Inform HR and Legal's assessment of appropriate measures and improvements needed in management practices.
Tell us what happened and which decision you need to make.
Talk to our specialistsSchools and educational institutions
Explore this applicationThreatening messages and posts about an institution need to be understood in context without amplifying rumours. Baruch organises reports, preserves available records and examines indicators in lawfully accessible sources to support school leaders and referrals to the teams and authorities responsible for the response.
Posts mention a school, a date or in-person activities but circulate alongside comments and reposts. School leaders need to separate original content from reproductions, understand its context and assess available indicators for referral to the appropriate teams and authorities.
Records of relevant posts and an assessment of the context and recurrence of indicators.
Contextualised alerts and attention priorities for the institution's responsible teams.
Support assessment and referral of the indicators to the appropriate teams and authorities, as relevant to the case.
Screenshots circulate without enough sequence or context. The institution holds materials that can be examined with authorisation and needs to organise what is known and what remains to be checked.
A timeline based on authorised digital materials, with documented origin and preservation procedures.
An analysis of the context and recurrence of threats, with attention priorities and points that remain unconfirmed.
Determine which information needs confirmation and gather records for responsible referral of the case.
Tell us what happened and which decision you need to make.
Talk to our specialistsHealthcare and health plans
Explore this applicationCharges unsupported by care records, inconsistent reimbursement requests and undisclosed provider relationships require a joined-up review. Baruch investigates documents, approvals and payment flows, preserving evidence and distinguishing process failures from indicators of fraud to support decisions by operational teams and legal advisers.
Reimbursement requests contain similar receipts for different appointments, changed amounts or procedures absent from available records. The health plan needs to compare documents, authorisations and payments, examine the files’ origins and establish whether the issue involves duplication, error or suspected fraudulent billing.
A timeline and reconciliation of the requests, care records, approvals and payments examined.
An analysis of documents and digital records, including assessment of possible editing indicators, documented origin and preserved evidence.
Decide which requests need closer examination and which checking and approval controls need review.
A group of clinics generates similar requests and referrals to the same providers. Possible connections to intermediaries or approvers are not clearly disclosed in registration records. The organisation needs to verify these relationships and compare authorisations to investigate favouritism or coordinated conduct.
A map of verified relationships and the requests within scope.
A report of evidence, gaps and recommendations to review relationships and controls.
Assess whether the relationship needs further checks, control changes or other measures.
Tell us what happened and which decision you need to make.
Talk to our specialistsAgribusiness
Explore this applicationThe origin of an input, collection of a shipment and identity of a broker can shape a transaction’s exposure. Baruch investigates suppliers, documents and negotiations across physical and digital channels to explain discrepancies, trace relationships and support decisions on payments, contracts and fund recovery.
A batch of fertiliser, crop protection products or seeds arrives with packaging, identification or origin different from the contract. Adulteration, counterfeiting or irregular provenance is suspected. The company needs to document the batch, investigate the supplier, broker and approver, and identify any technical checks required.
A map of the suppliers, intermediaries, approvals and origin documents examined.
A dossier of packaging, identification and distribution-channel records, with discrepancies and evidence for further checks.
Decide which batches and commercial relationships need closer review and which steps belong to the responsible teams.
A grain transaction progresses through messages, but the collection authorisation and payment account do not match the seller’s details. The company needs to reconstruct the negotiation, verify participants’ identities and connect the documents with the shipment and the destination of funds.
A timeline of messages, authorisations, shipment movements and payments, with documented discrepancies.
A verification report on the seller, intermediary and identified recipients, with a map of their connections.
Decide which payments or releases need verification and which investigation or recovery measures should be assessed.
Tell us what happened and which decision you need to make.
Talk to our specialistsEnergy and essential services
Explore this applicationDifferences between metering and billing, materials without a verified destination and inconsistent maintenance contracts call for a coordinated investigation. Baruch connects documents, field records, access logs and system changes to establish what happened and inform action on contractors, controls and the amounts involved.
Readings and bills show persistent differences alongside manual adjustments without clear justification. The company needs to compare field records, work orders and system changes to distinguish measurement faults, process errors and possible manipulation, identifying when a separate technical assessment is needed.
A timeline of readings, changes and charges within scope.
A report on access, documents and discrepancies, with the limits of the review recorded.
Decide which differences need further investigation and which recording and approval controls need changes.
Cables, meters and equipment leave the warehouse for service work but do not appear in installation records. Maintenance charges repeat and approvals are concentrated on one contractor. The company needs to reconstruct deliveries, identify those responsible and compare material consumption with payments.
A map of material movements, installations, work orders and payments examined.
A report on contractors, approvers and identified relationships, with supporting documents and outstanding checks.
Prioritise checks on materials and contractors and review delivery and installation verification.
Tell us what happened and which decision you need to make.
Talk to our specialistsInsurers
Explore this applicationAn inconsistency in a claim needs to be examined alongside its timeline, documents and participants. Baruch investigates events, service providers and payments to explain discrepancies, gather evidence and support case assessment, including tracing funds where there are indications that money has been diverted.
The account of a claim differs from dates, photographs and available records. The estimate includes possibly pre-existing damage, and some participants recur in similar incidents. The insurer needs to reconstruct events and verify connections without treating an isolated discrepancy as proof of fraud.
A timeline of the facts, documents, images and communications examined, including identified inconsistencies.
A map of connections between participants, providers and beneficiaries, with verified information and open questions.
Decide which facts need further investigation before assessing possible measures.
Bank details for a claim payment change during processing, and the beneficiary reports that the money was not received. The insurer needs to verify authorisations, identify documented recipients and examine connections between accounts, intermediaries and providers to assess possible recovery measures.
A map of documented transfers, amounts and identified destinations to support assessment of recovery measures.
A dossier on the recipients and intermediaries investigated, with connections and discrepancies against payment authorisations.
Guide further checks and assessment of measures by the appropriate teams.
Tell us what happened and which decision you need to make.
Talk to our specialistsConstruction and infrastructure
Explore this applicationProgress claims, contract amendments and payments need to reflect what was agreed and delivered. Baruch investigates documents, approvals, suppliers and financial flows when discrepancies arise, gathering evidence to support contract review, clarify responsibilities and assess possible measures concerning money that may have been diverted.
Approved progress claims include work without evidence of completion and materials without corresponding delivery. Amendments increase payments to the same contractor, who may be connected to an approver. The company needs to compare contracts, site records and approvals, coordinating the investigation with technical verification of the work.
A timeline and reconciliation of contracts, progress claims, amendments, deliveries and payments examined.
A map of connections between contractors, subcontractors and approvers, with documents and unresolved points.
Decide which contracts or payments need closer review and which approval controls to change.
Project funds move through subcontractors and third-party accounts without corresponding services in available records. Some companies share owners or addresses. The team needs to reconstruct flows, verify relationships and identify asset information that may support action concerning diverted money.
A map of documented transfers and identified asset information to support recovery measures.
A dossier of ownership and commercial connections between companies, owners and recipients, with supporting documents.
Assess what further information is needed and which steps may be considered with legal advisers.
Tell us what happened and which decision you need to make.
Talk to our specialistsLogistics and transport
Explore this applicationA load handed to the wrong person may start with a false registration, an altered message or an improper release. Baruch connects physical movements, transport documents and digital records to clarify suspected diversion, examine third-party involvement and inform the operational response.
The load was released against apparently valid documents, but the contracted carrier does not recognise the driver and delivery never occurred. The investigation must reconstruct the booking, gate identification and collection instructions to establish where substitution or impersonation may have occurred.
A timeline of booking, collection and cargo movements, with supporting documents and identified discrepancies.
A map of carriers, intermediaries and identified connections, with verified information on the activities of the third parties examined.
Determine next steps with Legal and changes to carrier checks, driver verification and cargo release procedures.
A driver receives a destination change from a contact appearing to represent the shipper. After delivery, the company finds that the address was not authorised. Messages, platform access and operational records need examination to distinguish account compromise, impersonation and improper internal approval.
A report of examined access logs and communications, with preserved records and the sequence of destination changes.
An analysis connecting the received instruction to cargo release and physical delivery, with gaps and investigation priorities.
Inform the response to the diversion and determine which instruction channels and confirmation steps require improvement.
Tell us what happened and which decision you need to make.
Talk to our specialistsMining
Explore this applicationDiscrepancies in origin, weight or procurement can affect the purchase, transport and sale of minerals. Baruch examines documents, company relationships and operational records to clarify concerns, connect available evidence and support decisions on suppliers, payments and controls across the business.
Invoices and origin documents name suppliers and extraction sites that do not reconcile with purchasing and transport records. The company needs to examine the supply chain, verify the information provided and establish connections between participants before expanding the operation.
A dossier on the suppliers and intermediaries examined, with a relationship map and discrepancies in origin documents.
An assessment of onboarding and document traceability controls, with priorities for addressing identified gaps.
Assess whether to continue the relationship, which additional checks are needed and what must change before approving new purchases.
A contractor reports machine hours and completed volumes above field records. Digital measurement files were changed shortly before approval. The company needs to compare recorded work, contract terms and the change history to clarify the basis for the charges.
A comparison of contracts, field logs, measurements and payments, with documents supporting each finding.
A timeline of versions and changes to the files examined, with preserved digital evidence and attribution limitations.
Support the review of charges and determine which approvals, access permissions and checks should change.
Tell us what happened and which decision you need to make.
Talk to our specialistsTechnology
Explore this applicationConcerns in a technology company may involve contracts, commissions, equipment or the use of business information. Baruch connects documentary, operational and digital evidence to establish what happened and inform decisions about people, partners, assets and processes, without treating a control weakness as proven fraud.
Contracts recorded as completed trigger commissions, but customers do not confirm the purchase or implementation never occurred. The company needs to compare proposals, acceptance, billing and service use, and investigate possible arrangements between staff and commercial partners.
A map of discrepancies across contracts, acceptance, delivery, billing and commissions, with a timeline of the transactions reviewed.
A report on examined approvals and conduct, with interviews and records linked to commercial policies.
Assess the transactions and conduct involved, and review the conditions for recognising sales and releasing commissions.
Before an employee leaves, unusual repository downloads and file transfers to external accounts appear. The company needs to establish what information was accessed, the sequence of events and whether the actions were authorised, while preserving records relevant to the assessment.
A report of the access events, files and transfers examined, with a timeline and preserved digital evidence.
A review of relevant accounts and permissions, with adjustment priorities for repositories and offboarding processes.
Inform Legal and HR's assessment of possible action and adjust access to business information.
Tell us what happened and which decision you need to make.
Talk to our specialistsPrivate equity
Explore this applicationBefore an investment or while managing an existing holding, inconsistent information can change a decision. Baruch examines counterparties and investigates concerns involving the companies concerned, connecting documents, relationships and transactions to support assessment of the investment and potential measures to resolve the issues identified.
A target company presents significant contracts and customer references that initial checks cannot confirm. Undisclosed connections to suppliers also emerge. Before proceeding, the investor needs to examine the counterparties further and investigate the discrepancies identified.
A verification dossier covering counterparties and stated information, with contextualised risks and questions for the investment decision.
A report on concerns involving customers and suppliers, with a relationship map and evidence concerning the discrepancies.
Decide whether the transaction can proceed, requires clarification or needs additional conditions before investment.
After investment, payments without a clear operational rationale emerge to businesses connected to former management. Contracts and deliveries do not support the amounts transferred. Approvals and the destination of funds need reconstruction to establish the facts and inform assessment of available measures.
A timeline of contracts, approvals and payments, with evidence and identified discrepancies.
A map of documented flows, relationships and identified assets, organised for counsel's assessment of recovery options.
Prioritise further investigation, improve portfolio-company controls and assess contractual or recovery measures with Legal.
Tell us what happened and which decision you need to make.
Talk to our specialistsFamily offices
Explore this applicationA payment instruction, investment opportunity or account statement may require independent verification. Baruch examines information, counterparties and asset movements to clarify concerns, organise evidence and support decisions by the family and its advisers about assets, trusted relationships and potential recovery measures.
A message apparently sent by a family member or adviser requests an urgent transfer. After payment, the instruction is disputed. The team needs to examine the communications, approvals and destination account details to establish whether funds were diverted and how it happened.
A report of the messages and access events examined, with a timeline and indicators of identity or account misuse.
A map of payments and identified relationships, with asset evidence supporting assessment of recovery measures.
Support the response with legal advisers and review how payment instructions and authorisations are confirmed.
An intermediary presents an opportunity using the name of a recognised institution, but contact details and documents do not match official channels. The family office needs to verify who is behind the proposal and clarify the discrepancies before committing funds.
A verification dossier on the people, companies and information stated in the proposal, with sources and unconfirmed points.
A report of investigated relationships and discrepancies, with evidence concerning the intermediary and other parties involved.
Assess counterparty credibility and determine what must be clarified before making an investment decision.
Tell us what happened and which decision you need to make.
Talk to our specialistsDistributors, sales representatives and resellers
Explore this applicationYour network of distributors, sales representatives and resellers connects your company to end customers. Discrepancies in discounts, commissions, product destinations or brand use require an understanding of what happened in the channel. Baruch examines transactions, documents and relationships to inform commercial decisions and improve the relevant processes.
A reseller requests special terms for a specific customer, but the products go elsewhere and the named buyer does not recognise the transaction. The company needs to check the information used for approval, the resale chain and possible connections to whoever authorised the benefit.
A map of resellers, buyers and identified connections, with verification of the information submitted to obtain the discount.
A timeline of orders, approvals, invoicing and documented product destinations, with discrepancies and next steps.
Assess the commercial relationship and possible contractual measures, and review discount criteria and evidence of sale.
Customers report differences in products sold by shops and profiles presenting themselves as part of the network. Authenticity, origin and permission to use the brand are in question. The investigation needs to document physical and digital offers and examine commercial connections between sellers.
A map of examined offers and brand uses, with records of outlets, profiles and suspicious products.
A report on sellers and identified commercial connections, with documents supporting analysis of origin and links to the network.
Prioritise incidents and support commercial, legal or platform-related measures, distinguishing concerns from confirmed facts.
Tell us what happened and which decision you need to make.
Talk to our specialistsLaw firms
Explore this applicationA law firm may need to clarify fraud affecting its clients or address misuse of its own identity. Baruch gathers physical and digital evidence and researches relationships and assets to support lawyers' analysis, with organised information for decisions on the investigation and subsequent action.
Clients receive messages containing lawyers' names, case details and requests for payment to release court-awarded funds. The firm needs to document the misuse of its identity, preserve messages and identify connections between profiles, documents and accounts reported by victims.
A map of profiles, pages and incidents involving misuse of the firm's name, with records for referral to the relevant channels.
A report of examined communications and files, with a timeline, preserved evidence and connections identifiable from available sources.
Support client communications, platform requests and assessment of legal measures with organised evidence.
A company approaches the firm after identifying suspicious payments and transfers to third parties. Documents are scattered and beneficiaries remain unclear. The lawyers need a reconstruction of events and asset information to assess potential courses of action.
A timeline and evidence matrix connecting documents, payments and involved parties, with outstanding questions.
An asset dossier covering identified assets, flows and relationships, with sources and research limitations.
Support decisions on further enquiries and assessment of recovery measures by the lawyers responsible for the case.
Tell us what happened and which decision you need to make.
Talk to our specialistsIllustrative situations, not client cases. Solutions and deliverables depend on the need, available information and agreed scope.
Contact Baruch
Chat on WhatsApp or prepare your enquiry using the form below.
Baruch · Physical and cyber fraud
Add your details and a short description to prepare your enquiry by email or WhatsApp.