A fraud investigation that followed the people, the vendors and the money
Allegations of fraud at an interior fit-out company could not be settled by looking at accounting entries alone. Six workstreams, across 10+ people and 1,000+ vendors, were brought together into one picture.
From our own project and product work. Client names and identifying details are removed, and some figures are rounded.
The situation
An interior design and fit-out company faced allegations of financial fraud. Procurement and subcontracting run through many hands: who picks the vendor, who approves the order, who certifies the work, who releases the payment. Each step can look correct on its own. What matters is how they connect.
The question was not only whether a transaction was recorded correctly. It was who was involved, who was connected to whom, and where the money went.
The scope
| Area | Scope |
|---|---|
| People | Background checks on 10+ people, with relevant associates also considered |
| Vendors and subcontractors | 1,000+ examined |
| Laptops | 4, imaged with FTK Imager and examined with Autopsy |
| Period | About four months |
Six workstreams
- People. Background, role, reporting line and what each person could actually do in the ERP: create vendors, raise and approve orders, process invoices, release payments.
- Vendors. Registration, tax details, addresses, bank accounts and ownership, and any links between vendors or to employees, such as a shared address or contact.
- Procurement. Concentration among a few vendors, contract values that grew after award, orders, receipts, measurement books and invoices that disagree, and approvals out of line.
- Money trail. Where each payment went next, with signs of layering: fast onward movement, many intermediary accounts, circular flows and payments split into pieces.
- Digital forensics. Forensic images of the laptops, examined and catalogued into labelled folders, with a written report for each device.
- Correlation. Putting it all on one timeline: what happened, when, who was involved and what evidence supports it.
The questions we kept asking
- What if two vendors that look independent are connected?
- What if a relationship exists outside the organisation chart?
- What if the person paid is not the person who ends up with the money?
- What if a transaction is fully documented but has no real substance?
- What if the clue only shows when two sources are read together?
What happened
The investigation produced an evidence catalogue, forensic imaging and examination records, Excel schedules that tie observations to their sources, and a forensic report on each device examined.
A transaction with no clear link to a source stayed unmatched, never forced onto one. This use case makes no claim that fraud was proven; the findings went to the people responsible for that decision.
What changed
- From transactions to relationships. People, vendors, documents and money are examined together.
- From exceptions to a sequence. Events are rebuilt in order, so their meaning is clear.
- A method that repeats. The same six workstreams can be applied to other investigations.
Products and services
ForenCity links people, entities and money flows. See investigations and forensics and construction and real estate.