Investigation Standards

Core components

When an alert becomes an investigation

Escalate from review to investigation when any of these is true:

• Multiple linked accounts or entities appear involved (see Fraud Rings and Collusion)
• Dollar exposure exceeds the investigation threshold (set per money path)
• Mule activity suspected: inbound funds from victims, rapid pass-through (see Money Mules)
• Insider involvement suspected (see Insider Fraud)
• Scam victim identified and funds may still be recoverable (see Authorized Push Payment (APP) Scams)
• Novel MO not covered by SOPs
• Legal, partner or law enforcement request
• Potential SAR that needs more than the alert record to support it (see BSA-AML and SAR Filing)
• Complaint or media exposure

Investigation tiers (illustrative)

How to build it

Methodology

1. Scope. State the investigation question explicitly: "Are these 14 accounts controlled by one actor cashing out referral rewards?" Scope creep is the main cause of investigations that never close.

2. Preserve. Snapshot account states, logs and linked data before they change or rotate. Apply holds or restrictions where needed to stop further loss, proportionate and documented.

3. Collect. Standard evidence set per mechanism (members detail in the relevant playbook):

• Transactions and money flow: in, internal and out
• Sessions, logins, devices, IPs, account changes (see Login Anomalies, Account Change Events)
• Identity and KYC records (see Identity Verification Outcomes)
• Customer contacts and support interactions (see Customer Contact Signals)
• Rewards, promos, receipts or claims as relevant
• Vendor and consortium signals

4. Expand. Use link analysis to find related entities through shared attributes: devices, instruments, payees, contact details, behavior (see Entity Link Analysis, Graph Analytics). Document why each linked entity is in scope. Shared attributes vary in strength. One shared IP on a mobile carrier is weak; a shared device plus a shared payout account is strong.

5. Analyze.

• Timeline: order events from first contact to cash-out
• Money flow: where value entered, how it moved, where it left, and what is still recoverable
• MO: classify against the taxonomy (see Loss Taxonomy and Attribution)
• Actor type: third-party, first-party, organized, insider, victim-authorized

6. Conclude. State the finding with a confidence level and the evidence supporting it.

Actions should be proportionate to confidence. Irreversible actions (closures, clawbacks, deny-listing) generally need "highly likely" or above.

7. Act.

• Account actions: restrict, close, deny-list (see Negative Lists and Deny Lists)
• Recovery: recall, reversal, clawback (see Reward Vesting and Clawback)
• Victim remediation
• Referrals: AML/BSA, legal, law enforcement, partners
• Rule and model feedback (see Fraud Strategy Lifecycle)

8. Document and feed back. Write the case record to the standard in Case Documentation Standards. Update labels for all linked entities. Record lessons.

Evidence standards

Escalation paths

Interviews and customer contact

• Customer contact during an investigation should follow a script approved by legal and compliance
• Never reveal detection methods or specific signals to the subject
• For suspected victims, use trauma-aware, non-blaming language. Scam victims are often coached to lie to protect the scammer (see Scam Victim Indicators).
• Document every contact

Artifacts and templates

Investigation plan (Tier 2–3)

1. Trigger and investigation question
2. Initial entities
3. Preservation actions taken
4. Evidence to collect
5. Expansion criteria (which link types qualify)
6. Stakeholders to inform: legal, AML, HR, partners
7. Target completion date
8. Interim containment actions

Investigator checklist

• Question scoped and documented
• Evidence preserved before action
• Every linked entity has a documented link rationale
• Timeline built
• Money flow traced to exits; recoverable amounts identified
• Exculpatory evidence recorded
• Conclusion with confidence level
• Actions proportionate to confidence
• Referrals made with timestamps
• Labels updated for all entities
• Case record meets Case Documentation Standards
• Lessons logged for strategy

Metrics

Pitfalls

• No question. Investigations without a scoped question sprawl.
• Action before preservation. Closing accounts before capturing evidence loses the trail.
• Weak links treated as strong. A shared IP on a mobile carrier or a common merchant isn't proof of common control.
• Confirmation bias. Once the investigator believes it's a ring, contrary evidence gets ignored. Require exculpatory notes.
• Labeling only the alerted account. The other 30 accounts in the ring never become training data.
• Missed SAR clocks. Investigations that take weeks can push the SAR deadline. Involve BSA early.
• Investigator access sprawl. Investigators need broad access, which is exactly why their access should be logged and reviewed (see Insider Access Controls).

Related

• Fraud Program Overview · Case Documentation Standards · Alert Review Operations · Fraud QA Program
• Playbooks: Playbook - Fraud Ring Investigation Members · Playbook - Money Mule Detection Members · Playbook - Insider Fraud Members · Playbook - Elder Exploitation Response Members
• BSA-AML and SAR Filing · Case Management Systems · Graph Analytics

Sources and further reading

• eCFR, 31 CFR 1020.320 Reports by banks of suspicious transactions: SAR thresholds, 30/60-day timelines, immediate notification, and treating supporting documentation as filed with the SAR
• COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (2023): a coordinated approach to investigation and corrective action; prompt investigation as a deterrent
• FinCEN Alert FIN-2023-Alert005 on pig butchering: behavioral indicators investigators should look for in scam-victim accounts
• FinCEN Alert FIN-2024-Alert004 on deepfake media: indicators of synthetic media in identity evidence; no single red flag is conclusive