IT Forensics · Private Individuals

How can I digitally document a fake online shop scam for the police, my bank or a solicitor?

Fake online shops often disappear after just a few days. Anyone who has paid through them will need documentation – such as shop pages, the legal notice, order confirmation, payment details and technical domain data – whilst the shop and domain are still accessible, in order to file a police report, request a chargeback or seek legal advice.

Enquire without obligation

Why this question is important for private individuals

Following a digital fraud incident, financial loss, time pressure and technical uncertainty all come into play. A well-structured investigation can help to organise the available evidence and distinguish between assumptions and events that can actually be substantiated.

Technical background

Fake shops often use stolen legal notice details, short-lived domains and payments in advance to various accounts. Technical characteristics such as the domain’s registration date, hosting and certificates may reveal patterns, but do not identify the operator.

Relevant evidence and data sources

• Order confirmation and emails with headers
• Payment details (IBAN, payment reference, payment service)
• Shop pages, legal notice and terms and conditions as a complete backup
• Domain registration details, IP addresses, certificate information

Borders

• It is not technically possible to identify the perpetrators; that is the task of the investigating authorities.
• If the shop is already offline, only archived copies and your own records can be used.

Possible results

• Secured shop and domain data with a timestamp
• Overview: Payments and Communication

Why LanCologne?

In cases of digital fraud, it is not just the fact that money is missing that matters. To establish the facts, it must be clarified which technical sequence of events can actually be verified: Was a phishing page opened?

Here’s how we do it

• Immediate backup of websites that are still accessible.
• A compilation of payment, communication and domain data.
• Report in a format suitable for use by the advertising agency and the bank.

Not every fraudulent payment means that the device has been hacked

Phishing, social engineering, stolen login credentials, compromised sessions and an actual device infection are technically distinct scenarios. We examine these possibilities separately and only explain the sequence of events as a finding that is supported by the available data.

Rapid damage control is a priority

If unauthorised transactions or account misuse are still taking place, the bank, payment service provider, card and affected accounts should be secured without delay. A forensic investigation will be planned around this; it must not artificially prolong any further damage that could be avoided.

Why LanCologne following a digital scam?

LanCologne does not attempt to spin a financial loss into the most dramatic account of an attack possible. We reconstruct the technically verifiable steps, document original sources and the limitations of witness statements, and present the findings in such a way that they remain understandable to the client whilst remaining technically comprehensible to lawyers, banks, insurance companies or investigating authorities.

Depending on the circumstances, different criminal law provisions may be relevant. Section 263 of the German Criminal Code (StGB) concerns fraud, and Section 263a of the StGB concerns computer fraud. Section 263a covers, amongst other things, financial losses resulting from the manipulation of a data-processing operation, for example through the unauthorised use of data. Which provision applies in a specific case is a legal question and is not decided by the IT forensic expert.

In the case of compromised accounts, Sections 202a et seq. of the German Criminal Code (StGB) may also be relevant. In the case of manipulated digital evidence, Section 269 of the StGB – which deals with the forgery of evidence-relevant data – may be particularly relevant, provided the legal requirements are met. However, the technical finding that a file or message has been altered does not automatically establish all the elements of the offence or the identity of the perpetrator.

For those affected, the priority following an ongoing fraud is to minimise the damage. The police and the BSI recommend taking swift protective measures in the event of hacked accounts or phishing, whilst at the same time documenting relevant digital evidence. A forensic investigation must not delay the necessary blocking of accounts, cards or payment methods.

In cases of disputed payments, issues relating to civil law and payment services law may also be relevant. Whether a payment was authorised, whether duties of care were breached or whether there is a claim for a refund must be assessed from a legal perspective. LanCologne can investigate the technical facts and chronology of events in this regard, but it does not replace legal advice and does not determine whether a refund is due.

A privately commissioned IT forensic report can document technical details in a way that is understandable to lawyers, banks, insurance companies or investigating authorities. It does not replace the investigative powers of the authorities, nor does it replace a court’s assessment of the evidence.

Frequently Asked Questions

Related topics

• How can I document fraud involving classified adverts or online marketplaces from a technical perspective?
• How can a private IT forensic report following online fraud help my solicitor, my bank or the police?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now